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-3 dB CUTOFF FREQUENCY: 


A parallel active mechanization where two or more 
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A parallel active mechanization, where two or more 
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The system output is the sum of the individual 
actuator output velocities. 
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1.0 INTRODUCTION 


Economically and competitively viable commercial aircraft of the future will have to take 
advantage of all possible gains in aerodynamic efficiency and weight reduction in order to 
improve fuel utilization, operating costs, and performance. Utilization of advanced 
technology flight control concepts will significantly contribute to the successful achieve- 
ment of these gains. 

The flight control systems of modern advanced aircraft are necessarily becoming complex 
and increasingly difficult to design and implement as more demands for added control 
functions, increased performance and operational capabilities, improved economics, and 
greater safety reliability and survivability are made. Furthermore, these advanced flight 
control systems require the integration of complex hydraulic actuators and electronic 
control systems. These design integrations are not easily realized due to implementation 
requirements and techniques. The associated implementation problems require careful 
attention to successfully develop the required advanced technology flight controls for 
aircraft of the future. 

This report presents the results of a quantitative study of two different actuator redundancy 
mechanization concepts that provide a fail-operational capability suitable for use in 
flight-critical control applications. This is the final report of Contract NAS2-7966, Mod. 
No. 3, Redundant Actuator Development Program. This contract study is the second phase 
of a program at NASA-ARC to develop and broaden the technology base of flight-critical 
flight control systems for the next generation of advanced technology commercial jet 
transport aircraft. 

Section 2.0 contains a summary of the study’s purpose, approach, results, and conclusions, 
the configurations studied, and recommendations for future developments. 

Section 3.0 contains the study’s ground rules and requirements. This section also describes 
the detailed approach and techniques, the detailed test and analysis procedure used, and the 
design tradeoff studies conducted in arriving at the final actuator configuration definitions. 
The results of the quantitative study are also contained and presented in this section. 

Section 4.0 contains the final definition and specification of the two actuator concepts 
studied. 

Section 5.0 discusses the applicability of the actuation concepts to advanced supersonic 
transport control systems as well as the applicability to other types of aircraft control 
systems. 
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2.0 SUMMARY 


2.1 STUDY PURPOSE AND APPROACH 

The Boeing Company has completed a study of flight control system redundancy 
mechanization applicable to aircraft requiring fail-operational control. This report presents 
the results of a quantitative evaluation of two different actuator redundancy mechanization 
concepts that provide a fail-operational capability suitable for use in flight-critical control 
applications. 

With the present state-of-the-art in hydraulic and electronic components, adequate safety 
cannot be guaranteed for flight-critical items on a single-channel basis. Redundancy 
therefore is required, which leads to additional complexity. The number of redundant 
channels required depends to a great extent on the method of mechanization. 

Two methods of actuator redundancy mechanization representative of those most likely to 
be used in future airplanes have been studied to provide a quantitative assessment of design 
application to an Advanced Supersonic Transport (AST) airplane. The two actuator 
configurations studied were a four-channel, force summed system and a three-channel, 
active/standby system. 

The study approach in producing a quantitative evaluation of the two actuator concepts was 
to (1 ) establish allowable actuation system operating characteristics based on a piloted 
evaluation of airplane handling qualities, (2 ) determine and evaluate, by analysis, the 
actuation system operating characteristics and configuration-sensitive parameters, and 
(3 ) quantitatively compare the two concepts relative to safety, reliability, maintainability, 
vulnerability, weight, and cost. 

2.2 STUDY BASELINE CONFIGURATION 

Producing a quantitative evaluation of alternative actuator concepts necessitated the 
selection of an appropriate baseline airplane type and configuration, a representative control 
system configuration, and equivalent actuator system configurations. This section establishes 
and describes the baseline configurations used in this study. 


2.2.1 CONFIGURATION REQUIREMENTS 

In the last few years, emphasis in new airplane configurations has mainly been directed 
towards improving economy and efficiency. Increasing reliability and safety, containing or 
reducing airfield lengths, enhancing flying qualities, and reducing noise and pollution. 

In the past, feedback control systems have been instrumental in improving handling 
qualities, reliability, and safety. The first applications were in autopilots, implying control 
of aircraft attitude to relieve the pilot on long stretches. Later, stability augmentation 
control became widely used, inferring better handling and smoother riding aircraft. More 
recently, feedback control systems with greater authority have been used to achieve precise 




control when the pilot could not adequately accomplish the task, such as in landing 
approach in poor visibility (e.g., autoland control). Although a hardover failure command in 
a low-authority system can be tolerated since the pilot can override and switch it off, 
hardovers in large-authority systems can lead to loss of control and catastrophe. It is 
necessary to safeguard against such failures by multiplexing control channels to identify and 
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An alternate approach to past practices associated with airframe designs is to configure the 
vehicle to take full advantage of the benefits of augmentation. Augmentation, as used in this 
context, is not restricted only to improvement of handling qualities but includes 
improvement of a variety of characteristics such as ride qualities, load alleviation, flutter 
suppression, performance, and any other area in which a benefit can be gained. The basic 
difference in this approach is that the configuration of the vehicle is dependent on the 
impact that the control system makes on the design. The flight control system then becomes 
as important as structure with respect to flight safety, and therefore the matter of system 
reliability and redundancy are a paramount concern. 

2. 2. 1.1 Airplane Configuration 


The purpose of this AST-funded study was to produce a quantitative assessment of the 
actuation-system design application to an AST airplane. To conduct this study a 
representative advanced airplane model, the Boeing 2707-300 SST, was selected as the 
baseline airplane configuration. 


The design development of the Boeing 2707-300 SST emphasized the achievement of an 
optimum configuration arrangement from the standpoint of aerodynamic and structural 
efficiency. Substantial improvements in weight, drag, and balance resulted from configuring 
the airplane with the c.g. limit aft of the maneuver-neutral point at subsonic speeds and 
sizing the longitudinal surface to meet control moment requirements rather than stability 
requirements. The resulting unstable airplane had to be augmented through the flight 
control system to provide acceptable handling qualities. This required incorporating a highly 
reliable stability augmentation system (SAS) that would ensure at least minimum-safe 
handling qualities. This minimum-safe SAS, being likened to basic structure, became known 
as Hard SAS or HSAS. The design approach for HSAS was to specify the simplest possible 
system that could assure at least minimum-safe handling qualities, to take all precautions to 
optimize the reliability of the system during manufacture and service, and to minimize 
maintenance requirements. 


Normal handling qualities were provided by an outer loop system called an electrical 
command and stability system (ECSS). This sytem was more complex than HSAS and used 
more conventional packaging techniques. 

Further, it was decided for the prototype SST airplane that when flight safety was 
dependent on an augmentation system, safety would be ensured by another means, until the 
reliability of the new design was proven in a true flight environment. This was accomplished 
on the Boeing prototype SST by providing a mechanical backup control mode. 
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The concept of dissimilar redundancy is significant in ensuring safety in aircraft control 
system designs. The more the dissimilarity between alternative means of control, the less the 
probability of a common failure mode or single failure event destroying all means of 
control. 

2.2. 1.2 Flight Control Configuration 

The 2707-300 longitudinal control system was selected as the baseline control system for 
this study. The following considerations were pertinent to selecting the B2707-300 SST 
pitch axis as the baseline: 

1. Considerable effort and development had gone into evolving the B2707-300 airplane 
and subsystems. 

2. The B2707-300 SST is currently mechanized and modeled on the NASA-ARC motion 
simulator. 

3. The actuator study relates directly to the “Handling Qualities” portion of this same 
contract study since critical flight configurations for the actuation system evaluation 
study were determined from the handling qualities work. 

2.2. 1.3 Safety/Reliability Criteria 

Safety is the primary purpose of the airworthiness requirement contained in Part 25 of the 
Federal Aviation Regulations. These requirements must always be kept in mind, as they are 
the standard by which airworthiness of the aircraft are judged. Besides the FAA regulations, 
consideration must be given to the requirements imposed by other nations on aircraft 
offered for sale within their jurisdiction. Among nations having specific airworthiness 
requirements are the United Kingdom, France, the Netherlands, Germany, Italy and 
Australia. 

Existing regulations (FAR 25.21(e)) recognize that acceptable flight characteristics may 
depend upon a stability augmentation system or upon other automatic or power-operated 
systems. 

With the present state-of-the-art in hydraulic and electronic components, adequate safety 
cannot be guaranteed for flight critical items on a single-channel basis. The probability of 
failure in a critical system must be extremely remote (extremely improbably) inferring that 
total system failure rate must be less than 1 x 10’^ failures per flight hour. Electrohydraulic 
systems on a single-channel basis demonstrate 1 x 1 0‘^ to 1 x 1 0“^ failures per flight-hour 
which falls far short of this goal. Redundancy, therefore, is required to make up this 
difference, which leads to additional complexity. The number of redundant channels 
required depends to a great extent on the techniques of mechanizing the system. 

The required level of overall function reliability is achieved in control systems by increasing 
redundancy for those functions that do not have the desired reliability. For example, 
controllability of the latest generation of large jet transports is dependent on the integrity of 
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the hydraulically powered controls. Reliability for safety of flight is provided by multiple 
hydraulic systems. The ultimate levels of reliability are required only for those functions 
needed for safe termination of flight. 

2.2.2 CONFIGURATION CONCEPTS 

The flight control systems of modern advanced aricraft are necessarily becoming complex 
and increasingly difficult to design and implement as more demands are made for added 
control functions, increased performance and operational capabilities, improved economics, 
and greater safety and survivability. Future aircraft will have to take advantage of all 
possible gains in aerodynamic efficiency and weight reduction with their impact on fuel 
savings, operating costs, and performance improvements to be economically and competi- 
tively viable. Advanced control requirements and advanced flight control system concepts, 
involving complex hydraulic actuators and electronic control systems, are not easily realized 
due to implementation techniques and associated problems. These problem areas require 
careful attention in the development of advanced technology flight control and aircraft of 
the future. 

Reliability and safety requirements for flight-critical control systems that convert and 
amplify flight control and stability augmentation commands to provide inputs to the 
control surface power actuators are determined by the need to remain operational in spite 
of control channel malfunctions. Actuation systems with fault-corrective capability to meet 
the reliability requirements and satisfy FAA regulations require at least four active channels 
or three monitored channels. Although the minimum redundancy level for flight-critical 
surface power actuators is three, surface power actuators could be mechanized with the 
higher level of redundancy. 

To meet these levels of reliability, special consideration must be given to the control system 
design. Such considerations include design simplification, derating of components, elimina- 
tion of electrical connectors, and physical isolation of electrical wiring and hydraulic power. 
Even then, redundancy is usually required to obtain satisfactory reliability from the 
complex hydraulic actuators and electronic control systems used in airplane flight controls. 

Use of redundancy to achieve reliability has always been an accepted engineering design 
technique. However, the advantages of redundancy are not easily realized in control systems 
because of signal channel interaction, failure effects, performance degradation after failures, 
null shift with channel switching, and failure detection problems. These problem areas with 
redundant control systems and actuators require careful attention in system design and 
mechanization. 

2.2.2. 1 Redundancy Requirements 

Redundancy requirements for flight control actuation systems can be divided into two 
areas, the requirement for flutter-free control surfaces, and the requirement for operative 
flight-critical control surfaces. 

The need to minimize airplane weight reduces the permissible use of control-surface mass 
balance as a means of preventing control-surface flutter. If mass balance is not used, the 
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surface must be restrained by the surface control system. The Federal Aviation Regulations, 
volume ill, part 25, paragraph 25.629, “Flutter deformation, and fail-safe criteria”, requires 
that an airplane be free from flutter after any single failure in the flight control system, plus 
any other reasonably probable single failure or malfunction affecting flutter. Hydraulic 
system failures are classified as reasonably probable by the FAA. Therefore, when the 
airplane design dictates that control surfaces be restrained by the surface power actuators to 
avoid the mass balance weight penalty, at least two surface power actuators and three 
hydraulic systems for each surface are required. 

Independent of considerations for suppression of surface flutter, surface power actuator 
redundancy is influenced by the need to maintain control of the airplane flight path. The 
Federal Aviation Regulations, volume III, part 25, paragraph 25.671 , requires that the 
airplane must be capable of safe flight and landing after any single failure, excluding 
jamming, in combination with any probable hydraulic or electrical system failure. 

One form of redundancy to assure continuance of a control function after failures would be t 
to use multiple-control surface segments, independently controlled, in each airplane axis. 
Control-surface redundancy, when used for failure tolerance reasons, requires surface 
oversizing so that the total authority exceeds the minimum requirement by some margin. 
Otherwise, the whole philosophy of multiple surfaces is invalid. If actuator redundancy were 
not required for prevention of flutter, each surface could be controlled by a single actuator. 
Degraded, but safe, operation could be possible if one or more surface segments became 
inoperative. This concept is used in some current airplanes. However, if the airplane design is 
such that a limited number of flight control surfaces are available or if all control surfaces in 
an axis are needed for flight path control, each surface must remain operative and 
controllable after certain dual-control system failures. 

Advanced supersonic cruise transport airplanes will probably be limited in the use of control 
surface redundancy, particularly in the longitudinal axis, because of the need to attain 
maximum aerodynamic efficiency. The need for minimum weight in an advanced supersonic 
transport airplane will also limit the consideration of mass balance for flutter prevention. 
These two factors are sufficient to set the minimum redundancy level for surface power 
actuators and show the need for redundancy in flight control actuation systems. 

The general approach to implementing a fail-operational control system is to use redundant 
channels and to have a way of rejecting erroneous outputs. The problems of developing 
fail-operational control systems can be separated into two interested areas: (1) design of 
the method for selecting an output from the redundant channels, and (2) design of the 
method for detecting and deactivating a failed channel. 

2. 2.2. 2 Actuation Redundancy 

There are two distinct types of actuator redundancy used in aircraft control systems. One 
type is the parallel-active configuration (fig. 1). The parallel-active configuration incorpo- 
rates multiple channels which perform identical control functions simultaneously. The other 
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type is the active/standby configuration (fig. 2), which incorporates multiple channels, only 
one of which controls the output of the system at any one time. The principal differences 
between the two types are as follows: 


The parallel-active technique requires the redundant control channels to be working 
together at some point in the control system. Hence, the failure of one of the control 
channels can cause an output performance change. For an active/standby system, the 
control channels operate independently and failures of the active control channel cause 
transfer to a correctly operating standby channel with no performance degradation. 


• The parallel-active system requires all of the control channels to be working at the 
same time. The failure of one channel is compensated for by the remaining correctly 
operating channels (to varying degrees). Therefore, it is not necessary to immediately 
deactivate the failed channel. In an active/standby system, rapid transfer between 
control channels is essential (with the actual required transfer time -determined by the 
particular application). 

There are three options available in the mechanization of parallel-active actuator systems. 
The control channels can be brought together and the actuator outputs summed by 
(1) force summing, (2) velocity summing, or (3) position summing (fig. 1). 

Force summing is the most common technique used in mechanizing parallel active systems. 
By force voting several actuators on a common output, an output representing the mid-value 
of all input commands can be achieved. One problem with this type of system that does not 
exist with other types is the force fight that can occur between actuator channels when 
channels differ in input command or actuator characteristics. 

Velocity summing is an alternate parallel-active mechanization which does not incur the 
force fight problems of the force summed systems. The best example of this mechanization 
uses servo motors summed through differential gear boxes. Net output velocity is the sum of 
the individual motor velocities and the force output is equal to the individual force outputs 
of the servo motors. 

Position summing systems have no actuator force fight. However, since the individual 
actuators are summed through differential linkages, a channel failure or actuator shutdown 
will reduce total output stroke capability. Each individual actuator must have a larger stroke 
than the minimum allowable output stroke to accommodate channel failures. This 
characteristic restricts the application of the position summing technique to systems that 
require only small displacement. It has been used in dual systems for series actuation. 
Mechanization becomes difficult when more than two actuators are summed because of 
mechanism complexity. 


2.2.2. 3 Implementation Factors 

There are several factors that must be considered when redundant actuators are used. The 
most significant are those that affect normal operation, affect operation after failures, and 
cause interface problems. These are failure insensitivity, failure monitoring, load sharing, 
and input mismatch. 
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Failure Insensitivity . —Failure insensitivity is the ability of a redundant control system to 
experience failures and automatically continue operation with an acceptable transient. If the 
system performs a critical function, operation must be maintained (be fail-operational) in 
the presence of one or more failures. However, a fail-operational system does not ensure 
minimum control-system transients. The criticality of transients has an effect on the detail 
design of the system. All the methods of redundancy mechanization previously discussed 
can be fail-operational. However, the number of channels required and the failure 
characteristics vary as in the following discussion. 

1 . Fail-operational capability can be achieved in parallel-active systems by majority voting 
or averaging three or more active actuators. With three active channels, operation 
continues after the first failure. With four channels, operation continues after two 
failures, if the first failed channel has been deactivated before the second channel fails. 
In the force-voted systems a failed channel is automatically overpowered by the 
remaining channels and the magnitude of the failure transient can be insignificant. 
Displacement and velocity summing provide an averaged output but have inherent 
failure transients and steady state null offsets after failures. The magnitudes of the 
transients are dependent on the system’s closed loop response. 

2. Active/standby systems require a failure detection system to assess that the active 
channel has failed, automatically disconnect it, and switch to a good channel. The 
failure transient is dependent upon the failure detection level, the switching time, and 
the tracking of the standby channel. 

Failure Monitoring .— Detection and indication of failures during operation must be provided 
so that failed channels or actuators can be deactivated to preserve the integrity of the 
system. The failure detection system must be designed to detect all types of failures; 
hardover, passive, oscillatory, and slowover or ramp which could produce an unsafe 
situation. 

The ability of the failure detection system to sort out legitimate failures from apparent 
failures that might occur due to adverse tolerances has an equivalence in reliability. If the 
failure detection system trips a channel off inadvertently due to an apparent failure, the 
equivalent mean-time-between-failure (MTBF) for the system may be significantly affected. 

Failures in parallel-active systems may be sensed by in-line monitoring of actuator 
characteristics or by cross-channel monitoring between active acuators. A method of 
reducing the number of redundant actuators is to use a model of a working channel for 
cross-channel monitoring. While this extends the system’s fail-operational capability with 
one less working channel, its effectiveness depends on how well the model matches the 
actual hardware. In certain applications, where actuators are large and where weight is 
critical, the model approach may provide a way to minimize overall weight. 

In active/standby systems each channel must be individually monitored for failure 
detection. Each control channel is usually duplicated or modeled to provide the comparison 
required to detect a failure of the active channel. 
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Load Sharing .— Load sharing is a measure of the ability of multiple actuators with identical 
inputs to work together in positioning a common output. Load sharing is a problem peculiar 
to force summed actuators since, obviously there is no force fighting in an active/standby 
system with only one channel controlling at a time, or in position summed and rate summed 
systems where forces of individual actuator channels are additive. 

Ideally, it is desirable that the load be divided equally among redundant actuators to 
eliminate any force fighting. However, tracking errors arise due to tolerance buildup in each 
actuator servo loop and actuator installation that tend to make each actuator seek a unique 
position, even though the input commands are identical. With the actuators tied to a 
common output all position commands will not be simultaneously satisfied and force fights 
will occur between actuators. 

To minimize the force fighting in force summed actuator configurations and assure 
acceptable sharing of the load, four methods are commonly used. 

1. Accurate tolerance control of the actuator feedback loop: A mechanical actuator can 
be mechanized with good tolerance control because of the manufacturing accuracies 
that are possible and the unchanging nature of the mechanical linkages. In contrast, an 
electrically controlled actuator has command path elements such as summing 
amplifiers, demodulators, and feedback transducers which can change characteristics 
with time, temperature, and power. It is generally accepted that the tolerances 
associated with an electrically controlled actuator are significantly greater than for a 
mechanically controlled actuator. 

2. Compliance between channels: In some applications the structural compliance 
between actuators allows sufficient individual actuator position difference to reduce 
force fights through the normal position feedback loop. 

3. Low force gain actuators: Low pressure gain servovalves can be used to reduce the 
force fight resulting from expected valve command differences to an acceptable level. 
In some applications a feedback path consisting of deflections of the actuators’ 
reaction structure is sufficient to provide the actuator force gain reduction, and 
reduced force fight. Another way to reduce actuator force gain is to use actuator load 
pressure as a feedback command. However, there is a limit to the amount of 
compliance that can be tolerated without reducing the overall actuator stiffness below 
a minimum allowable level. Reducing actuator force gain (stiffness) has been used 
successfully where inputs are reasonably matched, such as multiple surface power 
actuators signalled by a common mechanical command, or secondary actuators where 
the output load is small. 

4. Equalization to average load: For cases where the actuators are required to operate 
into large aerodynamic loads and have uncontrolled input mismatch, any pressure 
feedback system requires modification to be useful. The individual actuator load must 
be compared to the average load. Computation of the average load and the individual 
difference from average requires cross-channel comparison. This method does not 
degrade actuator stiffness but adds complexity * and introduces the possibility of 
cross-channel failures. 
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Input Mismatch .— Differences in commands (input mismatch) due to tolerances in the 
electrical control system, from sensor to actuator, can be quite high. As much as a quarter 
of full-scale command can result unless some design precautions are taken to prevent such 
buildup. It should be noted that differences in commands generated by actuator loop 
tolerances are generally an order of magnitude less than those generated by computational 
elements in the upstream portions of the system. The various methods of redundant 
actuator mechanization that deal with the input mismatch problem are as follows. 

1. Force summing systems: In force summing systems, the output is the mid value of all 
input commands. The force fight that occurs due to input command mismatch can be 
reduced by the same methods used to insure load sharing. In some applications the 
only possible means of controlling input command differences may be through the use 
of electronic signal command conditioning. 

2. Velocity summing systems: Velocity summed actuators allow the individual channels 
to cancel command differences by differentially summing rates. 

3. Position summing systems: Position summed actuators accommodate command 
differences by producing a single output which is the average of the input commands. 

4. Active/standby systems: Usually the active actuator is commanded by a single 
electronic channel and mismatch is no concern during operation. Mismatches between 
the commands of the active and the standby channel are of concern, however, and 
must be minimized to avoid large transients upon switching from active to standby 
actuators. 

2.2. 2.4 System Mechanization Concepts 

The concept of using multiple channels of similar control information is generally applied 
by utilizing some form of summing or decision process prior to the control surface, thus 
bringing the various signal paths together to form a common command. Surface actuator 
input signals can be either electrical or mechanical, or both. 

The power levels associated with the electronic signals for fly-by-wire command, autopilot, 
and stability augmentation systems are kept at low levels as a matter of good design. These 
low-level signals are required to command surface actuators that operate at high power 
levels. To transform the low-level electrical commands to surface displacements controlled 
by large hydraulic power actuators requires signal conversion and amplification. This is 
normally achieved using small electrically signalled hydraulic servo actuators as one of the 
stages of amplification to form a mechanical consolidation prior to the surface power 
actuators. These small actuators are termed secondary actuators (figs. 3 and 4). 

It is advantageous to treat the command computation and signalling errors independently 
from the power actuation errors through the use of the secondary actuator. Some of the 
advantages are: 
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• The secondary actuator can become a synchronizing stage between the two functions 
by providing a single-valued mechanical command. 




Although secondary actuators do not eliminate the problems of redundant actuators, 
the magnitude of the problems are less severe because the secondary actuators operate 


at significantly lower force levels than the surface power actuators. 


• When surface power actuators are isolated from the upstream command differences, 
the task of providing adequate power actuator load sharing becomes easier, permitting 
a simpler and more reliable mechanization. 


A major concern in developing a system concept is determining the best way to interface the 
system components and control modes. One of the more important decisions in establishing 
the skeleton of the actuation system concept is to determine how the mechanical control 
path and the redundant electronic control paths are to be mechanized. 

Considerable trade studies for this design decision were made during the Boeing B2 707-3 00 
SST development. In considering all the disadvantages and advantages of the alternative 
schemes, a summing interface method was selected. Although more complex, the summing 
interface allowed continued control of the surface through the mechanical path if a jam 
occurs in the secondary actuator output mechanism (fig. 3). 

The summing concept requires a centering detent (to ground) to ensure adequate control of 
the surface actuation system via the mechanical backup control after complete loss of 
electrical control. These detent springs can be either engaged continuously or engaged only 
after an electrical or hydraulic failure has occurred in a channel. If engaged continuously, 
the detents would act like nuisance loads to the secondary actuators in normal operation. At 
the expense of a slight increase in complexity, the detent springs could be caged (locked 
out) in normal operation, and then engaged only after a failure in that channel. This latter 
approach has the advantage of eliminating the unwanted detent loads from normal 
operation. This latter mechanization approach was selected for this study. 

2. 2.2. 5 Actuation System Concept Selection 

Four types of actuator redundancy have been discussed, i.e., force summed, velocity 
summed, position summed, and active/standby. The benefits of using secondary actuators as 
a means of signal conversion, signal amplification, and command path synchronization to 
control the surface power control actuators have been discussed. Surface power actuators 
are usually force summed mechanical input actuators. The system differences are in the 
redundancy mechanization of the secondary actuators. 

Although the use of velocity summing solves the problem of force fight there are 
disadvantages which make this type of system a questionable candidate for future use in 
critical flight control applications on civil aircraft. The complex gearing could make it 
difficult to prove that jam-type failures would be extremely remote, as required by FAA 
regulations. Also, for the same output force the electromechanical actuator is larger and 
heavier than an equivalent electrohydraulic actuator. 



Position summed systems are difficult to mechanize for more than two redundant channels 
because of the complex linkage required. In addition, the loss of rate and travel capability 
after failure and the inherent output position transient that occurs with failure are 
disadvantages. 

The active/standby and the force summed systems have advantages and disadvantages that 
must be considered in conjunction with the specific airplane and control system application. 

Of the options discussed, initial studies under contract NAS2-7653, Redundant Actuator 
Development Study (phase 1), disqualified all but the force summed approach of the 
parallel-active actuator systems and the active/standby approach for continued study. 

The study reported in this document, under contract NAS2-7966, concentrates on 
evaluating two secondary actuator mechanizations (force summed and active/standby). A 
quantitative evaluation was made of these two mechanization concepts to determine their 
operational and performance characteristics for normal conditions, for failure conditions, 
and for variations in critical design parameters. The two actuation concepts studied are 
shown schematically in figures 5 and 6. Functional diagrams of these concepts are shown in 
figures 7 and 8. Functional descriptions, referring to these figures, of the concepts are 
presented in paragraph 2.4.1. 

2.3 PILOTED SIMULATION EVALUATION (FSAA) 

A piloted motion simulator study was conducted on the flight simulator for advanced 
aircraft (FSAA) at NASA-ARC. This piloted simulator study evaluated the interaction of 
pilot, airplane, and control system. The purpose of this evaluation was to establish and 
define the allowable limits of critical actuation system design parameters. 

This section describes the baseline airplane and control system models used and the study 
approach taken, and summarizes the major results and conclusions of the simulation study. 
A more detailed presentation of the scope, background, test conditions, and study results is 
contained in paragraph 3.3. 

2.3.1 BASELINE AIRPLANE CONFIGURATION 

The B2707-300 supersonic transport airplane was selected as the baseline airplane 
configuration for this study. The four flight configurations selected as representative of the 
B2707-300 flight envelope, and utilized as the test flight conditions during the FSAA testing 
are listed as follows. 

1 . High speed cruise within normal operation boundary 

2. High speed cruise within minimum-safe operation boundary 

3. Landing approach within normal operation boundary 

4. Landing approach within minimum-safe operation boundary. 
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2.3.2 BASELINE CONTROL SYSTEM CONFIGURATION 


The B2707-300 longitudinal control system was selected as the baseline control system for 
this actuation study. 


This system is shown functionally in its entirety in figures 9 and 1 0, and represents the 
system used in conducting the piloted simulation study. The secondary actuator (EC Servo) 
functional block on these figures was modified consistent with the study. 


The EC servo model was expanded sufficiently to represent the secondary actuator system 
parameters critical to the definition and development of the secondary actuator concepts 
under study. This model did not represent a specific secondary actuator configuration. 
Rather, it consisted of linear filters, limiters, and time-dependent functions to allow 
simulation of the secondary actuator characteristics of importance to this study. As such, 
limitations on specific parameters were established to correlate with the Boeing based 
(analog) simulation to produce a quantitative evaluation of the candidate actuator concepts 
being studied. 

Figure 1 1 shows a functional diagram of the EC servo used in the study. The system was 
built around the existing EC servo model as indicated in the figure and was represented as 
single channel. 


2.3.3 STUDY REQUIREMENTS AND APPROACH 


The objective of this evaluation study was to establish design criteria for the secondary 
actuation system applicable to an AST flight-critical control system. These criteria were 
established based on pilot evaluation of manually flying a simulated supersonic transport 
airplane. A piloted motion simulation, using the FSAA at Ames, was used to investigate and 
evaluate various secondary actuator parameter effects on airplane handling quality 
characteristics. 


Tire simulation study was organized and planned to produce (l)a control transient 
evaluation to relate actuator transient variations with pilot rating, (2) a design parameter 
evaluation to relate actuator performance variations with pilot rating, and (3) a determina- 
tion of the allowable limits of critical actuation system design parameters. 

The testing performed on the FSAA simulator was divided into two categories. The first 
category evaluated the effects of different control system failure modes on airplane handling 
qualities. The second category investigated the effects of variations of actuator design 
parameters on airplane handling qualities. Each test category was evaluated at the four flight 
conditions described in paragraph 2.3.1 which included operation at landing approach and 
high speed cruise. The airplane configurations were chosen so that the handling qualities 
bordered on the lower limits of normal and minimum-safe operation. At each combination 
of airplane configuration and flight condition a test sequence was performed with changing 
actuator characteristics, until clear trends in pilot ratings were established. 
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The detailed test and evaluation procedures are presented and discussed in paragraph 3.3. 

The handling qualities criteria used in evaluating the results of the piloted simulation tests 
are as follows: 

1. With the airplane in a normal handling qualities state (i.e., PR^ 3.5), the airplane 
handling qualities shall not degrade below a PR of 3.5 following a single probable 
control system failure, and a PR of 6.5 following a second control system failure (i.e., a 
probable failure plus any other failure). 

2. With the airplane in a nominal minimum-safe handling qualities state (i.e., 4.5 < PR 
< 6.5) and with a normal flight control system (i.e., no flight control system lailures), 
the airplane handling qualities following a single control system failure shall not 
degrade below a PR of 7. 

The method by which these criteria were applied to the test data is shown in figure 1 2. 

2.3.4 MAJOR RESULTS AND CONCLUSIONS 

The test results of the FSAA evaluation are summarized in tables 1 and 2. Table 1 presents 
the failure transient test results summary and table 2 presents the actuator design parameter 
variations test results summary. 

These tables contain data showing the maximum magnitude of allowable surface transients 
for various types of failure modes and the maximum magnitude of allowable actuator 
system nonlinearities. These data have been established from the pilot evaluation results 
contained in figures 13 through 25 using the criteria of figure 12. Two sets of data are 
shown in both table 1 and 2, one for the high-speed cruise flight condition and one lor the 
landing approach flight condition. Typically, at these two flight conditions the airplane was 
evaluated at two levels of handling qualities; i.e., normal-operation handling qualities and 
minimum-safe handling qualities. For the normal-operation handling qualities airplane, two 
allowables are shown; i.e., for a First system failure and for a subsequent (second) system 
failure. For the minimum-safe handling qualities airplane, only a first failure allowable was 
established and is shown. 

Table 1 contains the summary of allowable failure transients for step, oscillatory (for 
constant frequency and for constant amplitude), and switching delay failure types. The 
values shown in the table are horizontal stabilizer deflection angle in degrees. 

Table 2 contains the summary of the maximum allowable magnitudes of actuator system 
nonlinearities; specifically deadband, hysteresis, and threshold. Similar to table 1, the 
allowable magnitudes shown are horizontal stabilizer deflection angle in degrees. 

Figures 13 through 25 present the test data. These figures contain data plotted as pilot 
rating (PR) versus either failure transient amplitude or actuator parameter variation. The 
figures are further categorized in relation to flight conditions and airplane handling qualities. 

Actuator step failures were found to be most critical during cruise. This is evident in 
figure 13 where, pilot rating appears very sensitive to step amplitude. At the high dynamic 
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pressure associated with supersonic cruise, control sensitivity becomes large, resulting in 
large load factor increments for small stabilizer surface deflections. Upsets caused by sudden 
changes in stabilizer angle resulted in prolonged load factor oscillations. 

During landing approach (fig. 14) step inputs proved most critical when they occurred 
immediately prior to or during landing flare and in the wrong direction, that is, nose down. 

An oscillatory failure at constant frequency, cj = 1 Hz, appeared to be a nuisance failure 
rather than serious hazard to the safety of the airplane (figs. 15 and 16). Although it rapidly 
degraded the normal handling qualities characteristics of the airplane, large amplitudes (of 
50% of maximum stabilizer deflection) were required before the handling qualities were 
forced beyond the criteria limits. The cause of this is believed to be filtering effects that the 
airplane inherently has at this frequency. 

The second sequence of oscillatory failures evaluated the effects of frequency variation. In 
figures 17 and IS it is obvious that the airplane-pilot combination was extremely sensitive to 
frequencies in the range of 0,1 Hz to 0.5 Hz. This observation would dictate that failures 
within these boundaries should be avoided for all failure modes. 

The switching delay tests were conducted to assess the effect of switching from an active to 
a standby channel in an active/standby secondary actuator system. These tests were run 
only at a landing approach flight condition. As is evident in figure 19, the airplane would 
sustain large switching delays before handling qualities boundaries were exceeded. 

Figures 20 through 25 contain the test results of the actuator design parameter testing. 

The test results indicate that the airplane configuration having baseline minimum-safe 
handling qualities generally appears more sensitive to variations in parameter magnitude 
than does the configuration having baseline normal handling qualities. The one exception to 
this observation is shown in figure 20. Also, the airplane displays greater sensitivity to 
parameter variations at high-speed cruise than it does for low-speed operations, such as 
landing approach. 

Figures 20 and 21 show the effect of deadband. The high speed cruise data of figure 20 
show a greater sensitivity to deadband than the landing approach data of figure 21. 
Furthermore, contrary to a general trend, the high-speed cruise normal-operation airplane 
was more sensitive to deadband than was the minimum-safe handling qualities airplane. 

Figures 22 and 23 show the effect of hysteresis. The normal-operation airplane at high-speed 
cruise and landing approach had about the same sensitivity to variations in hysteresis. 
However, the minimum-safe high-speed flight condition was considerably more sensitive 
than the minimum-safe landing approach flight condition. 

Figures 24 and 25 show the effect of threshold. Both the minimum-safe and normal- 
operation airplane had similar trends with the high-speed cruise flight condition being more 
sensitive to variations in threshold than the landing approach flight condition. 
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2.4 ACTUATION CONCEPT COMPARISON EVALUATION 


Tile two actuator concepts were developed and evaluated to produce a quantitative 
comparison. Included in this section are detailed descriptions of the concepts, requirements 
and study approach of the comparison evaluation study, and major results and conclusions 
of this study phase. A more detailed presentation of the trade study is included in 
paragraph 3.4. 

The active/standby and the force summed systems have advantages and disadvantages that 
must be considered in conjunction with the specific airplane and control system application. 
The most significant differences between the two types of mechanization are in the 
following areas. 

Normal Performance.— The single channel operation of the active/standby system can give 
optimum performance. In the force summed system, residual actuator force fight can affect 
output resolution and reduce actuator stiffness. 

Failure Transients. — The force summed system can be mechanized to give very small failure 
transients. The active/standby system design must trade failure detection levels and nuisance 
trips against allowable failure transients. 

Performance After Failure. -The active/standby system preserves normal performance in the 
failure sequence from the active channel to the standby channel and on to the second 
standby channel. The force summed system suffers a performance degradation as channel 
failures occur. This degradation can be exhibited as reduced resolution capability and force 
output. 

Failure Monitoring.- The active/standby system requires immediate failure detection to be 
safe following failures. Consequently, each standby channel in the active/standby system 
must be continually monitored to assure that it is capable ot control if the active channel 
fails. Furthermore, somewhere in the system a device like a switch or blocking valve is 
required to provide a successful transfer to a standby channel, upon detection ol a 
malfunctioning active channel. The force summed system does not require immediate 
detection of a failure to be safe. The force summed system utilizes only active channels 
continually monitoring each other and requires no immediate switching to be safe. Failure 
detection is only required to enable a failed channel to be shut down before another failure 
occurs. 

2.4.1 CONCEPT DESCRIPTIONS 

2.4. 1.1 Active/Standby Description 

The active/standby configuration incorporates multiple channels, only one of which 
controls the output of the system at any one time. To provide dual fail-operative 
performance; i.e., continue operation after sustaining two failures, the active/standby 
system redundancy level is triple channel. This is accomplished by making each control 
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channel essentially dual; an actuator channel and a model channel. The monitoring system 
compares the actuator channel with the model channel, and, if a disagreement exists, that 
control channel is deactivated. Using this form of in-line monitoring keeps the redundant 
control channel separate with a minimum of inter-channel connection. 

The control channels operate independently and failures of the active control channel cause 
transfer to a correctly operating standby control channel with no performance degradation. 
Because the standby control channels are not load sharing, they cannot oppose a failure in 
the active control channel. Therefore, rapid failure detection and transfer between control 
channels is essential to accomplish fail-operational performance. 

Referring to figures 5 and 7, each actuation channel, denoted by A, B, and C, is connected 
to the common output. One channel, at a time, is activated to become the active channel by 
deactivating its bypass valve. Deactivating a bypass valve allows that actuator to produce an 
output force and thereby allowing it to control the output. Simultaneously, the bypass 
valves on the standby channels are activated to bypass their respective actuators, thus 
preventing the standby channels from controlling the output. 

Once a channel is activated, then an input command, denoted by subscript c, to the servo 
summing amplifier produces an error signal to the servo valve. The servo valve responds to 
produce a hydraulic flow to cause the actuator piston to move. This movement is sensed 
electrically by an LVDT (linear variable differential transformer) to provide position 
feedback through the feedback electronics to the servo amplifier to close the position loop. 

Failure detection of an active channel is accomplished with a model channel that monitors 
the actuation channel. A servo amplifier, servo valve, position LVDT, feedback electronics, 
and a differential pressure transducer make up the monitor channel system. The amount of 
mistrack between the actuator channel and the model channel is measured as a servo valve 
Ap signal. If this signal becomes excessive, the failure detection logic is activated to bypass 
that active channel and to switch a standby channel to become a new active channel. 

2.4. 1.2 Force Summed Description 

The parallel-active, force summed configuration incorporates multiple channels which 
perform identical control functions simultaneously. The parallel-active system requires all of 
the control channels to be working at the same time and working together at some point in 
the control system. 

Fail-operational capability can be achieved by majority voting three or more active 
actuators. Dual fail-operative performance is provided with four channels, if the first failed 
channel has been deactivated before the second channel fails. A failed channel in the force 
summed system is automatically overpowered by the remaining channels and the magnitude 
of the failure transient is minimized. The failure of one channel is compensated for by the 
remaining correctly operating channels (to varying degrees). Hence, the failure of one of the 
control channels can cause an output performance change. However, it is not necessary to 
immediately deactivate the failed channel. 

Referring to figures 6 and 8, each of the four actuation channels (A, B, C, and D) is 
connected to the common output. Each actuator channel is activated by operating its 
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bypass valve to not bypass, thereby allowing that actuator to produce an output force. In 
normal operation, all four channels are activated to function together. Once an actuator 
channel is activated, an input command to the servo amplifier produces a signal to the servo 
valve which, in turn, produces a hydraulic flow to cause the actuator piston to move. This 
movement is sensed by an LVDT to provide an electrical feedback signal through the 
feedback electronics to the servo amplifier to close the position loop. Should all four 
channels not go to exactly the same output position, each of the actuator channels will 
oppose the others. In doing so, the attempt to produce an output position causes a 
differential pressure to build up within the actuator. 

Electrical and mechanical unbalances between the four servo channels are corrected by 
feeding back to the position loop, a signal proportional to the valve Ap. This signal is shown 
integrated electronically and fed back to provide the necessary steady-state balancing input. 
These signals are also fed through a failure logic, such that if the signals exceed a specified 
magnitude for a certain period of time, a channel failure is indicated, and that channel is 
deactivated. Operation continues on the remaining channels. 

2.4.2 STUDY REQUIREMENTS AND APPROACH 

The objective of the concept comparison study was to produce a quantitative evaluation of 
the two selected actuation configurations. The general approach taken was to conduct an 
extensive simulation study using an analog computer, and to conduct various analytical 
trade studies. 

The analog simulation study was used to develop the detail mechanization definition of 
both actuator concepts, to evaluate their operational and performance characteristics, and 
to determine the sensitivity of design parameter variations on their operation. 

Performance criteria used in the analog simulation study were frequency response, transient 
response, resolution, and failure transients. 

Performance characteristics for each criterion were determined for normal operation and for 
failed channel(s) operation. 

Analog simulator tests were also conducted to determine the sensitivity of varying these 
actuator design parameters: valve pressure and valve flow gain, valve flow limit, system 
backlash, actuator friction and damping, actuator rod spring, and actuator dynamic spring. 

The effect of parameter variations were determined by evaluating changes in performance 
characteristics. 

The analog study was divided into a configuration definition phase and an evaluation phase. 
In the first phase, each secondary servo actuator concept was analyzed to determine the 
effect on system performance and failure detection capability when using a single-stage or 
two-stage servo valve. During this phase, failure detection thresholds and time delays were 
established to minimize failure transients during failure conditions and to avoid nuisance 
failures during normal operation. During the second phase, performance under normal 
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operating conditions and under failure conditions were evaluated. Similarly, each system’s 
sensitivity to design parameter variations was evaluated. 

The analytical trade studies compared the two actuator concepts relative to safety 
reliability, malfunction reliability, survivability /vulnerability, and system implementation. 
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Performance characteristics of both the active/standby and the force summed systems are 
summarized in figures 26, 27, and 28. 

The frequency response plots on figure 26 show that the force summed system has a better 
frequency response characteristic than the active/standby system. This is attributed to the 
greater force capability of the force summed system. For normal operation, the force 
summed system had four times the force capability of the active/standby system. 

After a channel failure was detected and disengaged, the force summed system’s frequency 
response characteristics were degraded. Furthermore, the steady-state output was reduced 
due to the added detent load as channels were disengaged. 


The active/standby system showed no loss in frequency response after switching from an 
active to a standby channel, since a standby channel has the same performance capability 
when activated. 


Figure 27 depicts the transient response characteristics of the active/standby system and the 
force summed system (normal operation, one disengaged channel, and two disengaged 
channels). Under normal conditions both systems displayed very similar transient response 
characteristics. However, upon channel failure detection and disengagement, the force 
summed system showed a degraded transient response characteristic caused by the centering 
detent spring that is engaged to the system output upon channel disengagement. The 
centering detent spring always forces the position output towards null. Thus, whenever the 
command is away from null, the centering detent acts to retard that motion. For commands 
toward null, the centering detent acts to enhance that motion. No similar centering detent 
spring is engaged in the active/standby system. Therefore, no similar performance 
degradation was observed with the active/standby. 

Resolution data for the two systems are presented in figure 28. For normal operating 
conditions, the force summed system had better resolution characteristics (less hysteresis 
loss) than the active/standby system. This is attributed to the greater force capability of the 
force summed system. However, channel disengagements degraded the force summed 
resolution characteristics, but did not affect the active/standby system. 

The force summed system resolution data also showed an output versus input gain reduction 
about null for one and two channel failures. The reason for this gain reduction about null is 
the system centering detents that are added as channels are disengaged. These absorb some 
of the system force capability. However, when the actuation system overcomes the 
maximum detent force level, the output to input gain returns to normal. 
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Figures 29 and 30 summarize the comparison of the active/standby and force summed 
failure transients due to slowover, high gain, passive, step, and oscillatory failures. 

No oscillatory failure monitoring system was modeled for either system. However, under 
certain conditions, an oscillatory failure was detected as a slowover failure. 

Generally, the active/standby system experienced larger failure transients than the forced 
summed system. The failure transient due to a faulty force summed channel was attenuated 
by the remaining good channels and was limited in magnitude by the failure detection 
threshold. The active/standby failure transient was not attenuated, although it was limited 
in magnitude by its failure detection threshold. 

The data analyzed to evaluate the relative (active/standby and force summed) system 
sensitivities to variations in actuator design parameters are summarized in figure 3 1 . This 
figure shows that the parameter valve pressure gain, valve flow limit, and actuator dynamic 
spring have no, or relatively insignificant, effect on actuation system performance. Figure 3 1 
also shows that valve flow gain, system backlash, actuator friction, damping, and actuator 
rod spring are the design parameters having the greatest effect on actuation system 
performance. 

As a result of the studies conducted, the two actuator concepts were evaluated and ranked 
relative to each other. The ranking of the two concepts based on the selected criteria is 
presented in table 3. These criteria are not weighted and only a qualitative comparison is 
stated (i.e., better or worse). The quantitative data substantiating table 3 are contained in 
paragraph 3.4. 

The comparison indicates that the force summed concept better meets performance 
requirements than does the active/standby. However, the active/standby is superior in 
meeting reliability, maintainability, survivability, weight, and cost requirements. 

2.5 CONCLUSIONS AND RECOMMENDATIONS 

The Boeing Company has completed a study of flight control system redundancy 
mechanization applicable to aircraft requiring fail-operational control systems. 

Two methods of actuator redundancy mechanization representative of those most likely to 
be used in future airplanes have been studied to provide a quantitative assessment of design 
application to an AST airplane. The two actuator configurations are a four-channel, force 
summed system, and a three-channel, active/standby system. 

As a result of the studies conducted, the two actuator concepts were evaluated and ranked 
relative to each other. The comparison indicates that the force summed concept better 
meets performance requirements than does the active/standby. However, the active/standby 
is superior in meeting requirements of reliability, maintainability, survivability, weight, and 
cost. Based on these observations, the force summed, secondary actuator system would be 
the most likely candidate at this time, for an AST application. 

In other aircraft applications, where stability augmentation control requirements are less 
severe and actuator system performance requirements are less stringent, the active/standby 
system would be a strong candidate. 
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The actuator configurations were developed in as generalized a form as practical to obtain 
the basic knowledge and experience of the operational performance characteristics of the 
two concepts. 

Actuator math models of the two configurations were developed and simulated on an analog 
computer. This simulation study provided the following: 

1. A detail definition of the configurations and component mechanization 

2. An evaluation of failure detection implementation methods 

3. An evaluation of normal operational performance 

4. An evaluation of performance over a wide range of failures 

5. A determination of actuator configuration sensitive parameters 

6. A determination of critical actuator system parameters pertinent to the piloted motion 
simulation study task 

Safety reliability, maintainability, vulnerability, weight, and cost were assessed to aid in 
establishing a mechanization preference, in addition to defining the detailed mechanizations 
of the two concepts and determining and comparing their operational and performance 
characteristics. 

Acceptable control system performance is determined by the airplane stability and control 
characteristics consistent with the mission requirements. The failure-corrective character- 
istics of an actuation system are the performance characteristics that the control system 
exhibits when going from one operating mode to another as a result of a component or 
channel failure; these are as important as the performance characteristics in each failure 
mode. The general criteria developed in this study relative to acceptable performance 
degradation and failure transient characteristics for the secondary actuation system were 
based on pilot ratings of airplane handling qualities. The interaction of the pilot and airplane 
response with redundant control system designs is important because of performance 
changes and control transients that occur with failures or actuation shutdown. A piloted 
motion simulation using the FSAA at Ames was used to investigate and evaluate these 
effects. No criteria were established relative to augmentation or autopilot control 
requirements. The piloted simulation study provided the following: 

1. A control transient evaluation to relate actuator transient variations with pilot rating 

2. A design parameter evaluation to relate actuator performance variations with pilot 
rating 

3. A determination of the allowable limits of critical actuation system design parameters 



Future advanced airplane configurations are expected to include major design changes in 
order to achieve important desired benefits. Some of these recognized benefits are improved 
airplane performance and utilization, improved costs, maintainability, and survivability, 
design flexibility, precision control and optimum reponse. 

Advanced flight control technology will play an important part in the successful 
accomplishment of producing these benefits. The significant payoff of advanced control 
approaches is in the selection of the initial aircraft configuration through an aircraft design 
approach which permits full tradeoffs between aerodynamics, structures, and controls. 

In the commercial market, aircraft utilization is becoming more and more significant. 
Airline economics are affected by schedule reliability which, in turn, is related to such 
factors as air space and terminal-area congestion, and weather. The impact of all-weather 
operation is exemplified by the installation of automatic landing systems as basic equipment 
on the fastest generation of commercial aircraft. Automatic landing system requirements 
have had a significant impact on the resulting flight control system configuration. The 
changing air traffic control environment will undoubtedly have a similar impact on the 
system design resulting in a requirement for more automation in the flight controls area. 

Clearly, safety must not be compromised. When relying on the control system for basic 
flight safety at all times, a complete failure is intolerable. Sufficient redundancy must 
therefore be built into all sections of the control system and power supplies to ensure 
survival in the event of local failures and to reduce the risk of total failure to a very 
low level. 

Design freedom should be maintained to allow practical use of current technology in 
whatever combinations best satisfy the specific requirements, provided that sufficient 
confidence has been established in the technology to warrant its use. However, the point at 
which new technology has been sufficiently demonstrated for reasonable technical and cost 
risk is often a difficult question to answer. 

There is considerable planning underway to work on active control design procedures and 
applications to provide a comprehensive base for applying active controls to future civil 
aircraft designs. 

The successful demonstration of any of the advanced control concepts is heavily dependent 
on the associated control system and its mechanization. Since computation and actuation 
systems are key elements of any control system, the promise of advanced controls will not 
be realized until the technology for providing the required reliability with acceptable system 
cost is in hand. Therefore, it is of utmost importance to ensure that the control system 
design capability is available to allow the utilization of advanced control concepts in the 
next generation of commercial transports. 

The conclusions reached in this study indicate a continued need for research and 
development of flight critical, secondary actuator systems. Specifically: 

1. Develop the true active/standby concept to a hybridized active/on-line concept. 
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2. Develop detail hardware design definitions of the force summed, active/standby, and 
hybridized active/on-line actuator concepts. 

3. Develop detail definitions of failure monitoring systems for these same actuator 
concepts. 

4. Develop the electronic and mechanical interfaces and evaluate their mutual effects for 
these same actuator concepts. 

5. After developing these first four items, quantitatively determine the advantages and 
disadvantages of the three actuator concepts. 

6. Based on the results of item five, fabricate and test the appropriate actuator concepts 
in a mini-rig suitable for interfacing with a piloted simulator, like the FSAA at 
NASA-ARC. 

7. Conduct a piloted simulation evaluation with the actual actuator hardware interfaced 
with a simulated advanced flight-critical, airplane control application. 

8. Fabricate and test flight worthy, redundant secondaiy actuator hardware. 

9. Demonstrate and evaluate flight worthiness of flight-critical, redundant secondary 
actuator mechanizations in a flight test program. 
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Figure 1. —Parallel /Active Mechanizations 











Figure 2.— Active /Standby Mechanization 














Figure 3. —Control System Schematic 





Advantages: 


(Typical flight critical electric command) 


• Interfaces 4 electronics to 3 power actuators 

• Intermediate signal power amplification 

• Redundancy management problems treated at lower force levels 

• Single valued command to surface actuators 

• Surface power actuators isolated from upstream command anomalies 

• Permits simpler and more reliable surface power actuator mechanization 


Figure 4.— Secondary Actuators 
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Figure 5.- Active /Standby Actuator , Single Actuator Element 




Figure 6.— Force-Summed Actuator, 





Channel A 



Figure 7.— Triple Channel , Active /Standby, Secondary Actuator 
Functional Diagram 
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Figure 8.— Quad Channel, Force Summed, Secondary Actuator 
Functional Diagram 
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Figure 9.-B2707-300 Longitudinal Control Actuation System Schematic 
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Figure 10. -Block Diagram , B2707-300 Longitudinal Control System 









Figure 1 1 .-Secondary Actuator (E.C. Servo) Functional Diagram 
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Figure 12.~ Evaluation Criteria FSAA Simulation Tests 
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Pilot rating 
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Figure 14.— Landing Approach Step Input Sensitivity 
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Pilot rating 



(w= 1Hz} 

Figure 15.— High Speed Cruise , Oscillatory Amplitude Sensitivity 
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Oscillatory amplitude, degrees 
co = 1 Hz 

Figure 16.— Landing Approach, Oscillatory Amplitude Sensitivity 
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Pilot rating 
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Figure 17.— High Speed Cruise, Oscillatory Frequency Sensitivity 
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Pilot rating 
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Figure 18.— Landing Approach, Oscillatory Frequency Sensitivity 
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Figure 19.— Landing Approach, Switching Delay Sensitivity 
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Figure 23.— Landing Approach , Hysteresis Sensitivity 
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Figure 24.— High-Speed Cruise, Threshold Sensitivity 
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Figure 25. —Landing Approach , Threshold Sensitivity 
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See note 
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Figure 26.— Frequency Response Performance Degradation Comparison 
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Table 1. —Summary of Failure Transient Test Results 


Landing Approach 


Failure 

category 

Baseline airplane handling qualities level 

Normal 

Min. safe 

1st failure 

2nd failure 

1st failure 

Step, degrees 

<1.85 

<5.7 

<1.85 

Oscillatory (td= 1 Hz) ampl, deg 

<1.30 

- 

<4.0 

Oscillatory co, Hz (1) 

>1.0 

- 

>1.0 

Switching delay, sec 

< 1.0 

<3.65 

- 


High Speed Cruise (M = 2.7) 



Baseline airplane handling qualities level 

Failure 

category 

Normal 

Min. safe 

1st failure 

2nd failure 

1st failure 

Step, deg 

<.75 

<2.0 

<1.15 

Oscillatory (gj = 1 Hz) ampl, deg 

<.25 

- 

- 

Oscillatory (ampl = 2 deg) 
co, Hz 

>.5 



> .5 

Switching delay, sec 

- 

- 

- 


Note: Failure transient levels represent stabilizer deflection angle. 

(1): Min. safe ampl = 4 degrees 

normal ampl = 8 degrees 


Ceding 
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Table 2. Summary of Actuator Design Parameter Evaluation Test Results 


Landing Approach 


Parameter 

category 

Baseline airplane handling qualities level 

Normal 

Min. safe 

1st failure 

2nd failure 

1st failure 

Dead band, deg 

<.2 

< 5.8 

- 

Hysteresis, deg 

<5 

<6.5 

<3.7 

Threshold, deg 

<1.7 

<9.7 

- 


High-Speed Cruise (M = 2.7) 


Parameter 

category 

Baseline airplane handling qualities level 

Normal 

Min. safe 

1st failure 

2nd failure 

1st failure 

Dead band, deg 

- 

<1.15 

- 

Hysteresis, deg 

- 

- 

< 1.15 

Threshold, deg 

<.5 

- 

- 


Note: Parameter magnitudes are given in terms of stabilizer deflection angle. 
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Table 3. — Actuator Concepts Comparison Summary 


Criteria 

Active/standby 

Force summed 

Number of actuator channels 

Better 

Worse 

Normal performance 

Worse 

Better 

Failure performance 

Better 

Worse 

Failure transients 

Worse 

Better 

Safety reliability 

Better 

Worse 

Maintainability 

Better 

Worse 

Vulnerability 

Better 

Worse 

Volume 

Better 

Worse 

Weight 

Better 

Worse 

Cost 

Better 

Worse 
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3.0 DESCRIPTION AND RESULTS OF STUDY TASKS 


This section, summarized in section 2.0, presents the detailed results of the studies 
conducted under this contract. Specifically, the study ground rules and approach, the 
piloted simulation evaluation results, and the concept comparison study results are discussed 
in the following paragraphs. 


3.1 STUDY GROUND RULES 

The overall objective of this study was to broaden the technology base for evolving the most 
suitable and advantageous actuation system concepts for future advanced airplane flight 
control systems. Two alternative and specific candidate actuation concepts were investigated 
and evaluated to obtain the basic knowledge and experience of the operational and 
performance characteristics of the concepts as a basis for determining their applicability and 
practicality for AST control systems. The study provided a genuine determination of 
actuator system operating characteristics, handling qualities effects, and various failure 
modes with flight crew interaction and simulated airplane response. A detailed design 
definition was produced and comparisons were made of the two systems to evaluate their 
advantages and disadvantages. A study with the B2707-300 SST simulated on the FSAA at 
NASA-ARC established allowable limits of critical actuation-system design parameters for 
use in developing the detailed design definition of the two concepts. This simulation study 
was conducted in conjunction with the “Development of Handling Qualities Criteria for 
Large Advanced Supersonic Aircraft” study contract. To determine the applicability and 
practicality of the candidate actuation concepts for an AST, these concepts were developed 
and configured in conjunction with a suitable, specific AST requirement. The B2707-300 
pitch axis control system as currently mechanized in the NASA-ARC simulation was the 
basis for formulating the actuation system initial design requirements. 

3.2 STUDY APPROACH 

The technical approach involved conducting studies in three areas. 

A piloted motion simulation using the FSAA at Ames was used to investigate and evaluate 
the interaction of the pilot and airplane response with performance changes and control 
transients that occur within the actuation system. This piloted simulation study provided 
the following data: 

1 . A control transient evaluation to relate actuator transient variations with pilot rating 

2. A design parameter evaluation to relate actuator performance variations with pilot 
rating 

3. A determination of the allowable limits of critical actuation system design parameters 

A quantitative evaluation was made of both actuator mechanization concepts to determine 
their operational and performance characteristics for normal conditions, for failure 
conditions, and for variations in critical design parameters. 


preceding page blank not films! 
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Actuator math models of the two configurations were developed and simulated on an analog 
computer. The actuator configurations were developed in as generalized a form as practical 
to obtain the basic knowledge and experience of the operational performance characteristics 
of the two concepts. This simulation study provided the following: 

1 . A detail definition of the configurations and components mechanization 

2. An evaluation of failure detection implementation methods 

3. An evaluation of normal operational performance 

4. An evaluation of performance over a wide range of failures 

5. A determination of actuator configuration sensitive parameters 

6. A determination of critical actuator system parameters pertinent to the piloted motion 
simulation study task 

In addition to defining the detail mechanizations of the two concepts and determining and 
comparing their operational and performance characteristics, safety reliability, maintain- 
ability, vulnerability, weight, and cost, trade studies were also conducted to aid in 
establishing a mechanization preference. 

3.3 PILOTED SIMULATION STUDY 

A piloted motion simulation evaluation was conducted on the FSAA at NASA-Ames. This 
evaluation corresponded to task 3 of the study contract. This section describes the purpose 
and background related to the simulation test, presents a summary and conclusions of the 
evaluation, and discusses the simulation test and test results. 

3.3.1 SCOPE AND BACKGROUND 

The purpose of the piloted motion simulation test was to define the allowable limits of 
critical actuation system design parameters for the B2707-300 pitch axis EC servo. This 
simulator test was conducted with the FSAA at Ames immediately following the second 
handling qualities simulation session under the base contract, NAS2-7966. 

The original plans for this study required analog models of the two study concepts to be 
interfaced with the digital simulation of the B2707-300 on the FSAA. However, limitations 
on the analog model frequency content imposed by the sampling rate of the digital 
simulation and insufficient analog computer hardware, resulted in a reevaluation of the 
secondary actuator representation to be used in conducting the piloted tests. Thus, a 
different approach to achieve the same results was needed. The approach selected was to 
represent the actuator system on the FSAA only; i.e., only digital and no analog 
representation. The study objectives and purpose remained the same, and would be satisfied. 
The following considerations were significant in modifying the original plan: 
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• Analog computer capability permitted only two-channel implementation. 

• Analog/FSAA interface limited actuator system natural frequency to less than 2.5 Hz 
to avoid instabilities. 

• Element of risk involved to interface analog simulation to FSAA digital simulation. 

• Study objectives could be satisfied (i.e., actuator critical design parameters could be 
evaluated) with use of FSAA simulation only. 

• FSAA digital simulation could be increased from 1st to 4th order to improve 
representation. 

• FSAA table look-up routines could be used to simulate transients. 

• FSAA could not be programmed to shift from one channel characteristic to another 
without having to IC the computer. 

• No analog simulation required if use FSAA only. 

• Flexibility to directly relate the actuator system to airplane performance would be 
compromised, yet end results would be the same. 

• Boeing-based simulation work tasks would be increased to describe and evaluate critical 
actuator system parameters yet analog implementation task on the FSAA would be 
eliminated. 

The decision not to interface an analog representation of the actuator system with the 
FSAA is not meant to suggest that interfacing the FSAA with an analog representation 
(either computer or hardware models) at some other time would not be desirable. At a 
future time it could be very desirable to evaluate the discrete transient effects and 
nonlinearities of the actual secondary actuator systems with a piloted motion simulator. 

3.3.2 SIMULATION TESTS 

The actuation system simulation tests were conducted in conjunction with, and immediately 
following the second simulation session of the “Handling Qualities Criteria” development 
testing on the FSAA. The simulator test time was scheduled for two weeks to conduct the 
actuator system study. The actuator study test was consistent with, and dependent on, the 
handling qualities work (particularly the FSAA studies) of the basic contract. The airplane 
configurations and flight conditions were selected on the basis of the handling 
qualities work. 

3. 3. 2.1 Simulation Configuration 

Four airplane test configurations were selected as representative of the B2707-300 aircraft 
flight control envelope. The four configurations represent a high-speed cruise flight 
condition and a landing approach flight condition, both within a normal operation 
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boundary and a minimum-safe operation boundary. The longitudinal control characteristics 
of both flight conditions are depicted on figures 32 and 33. 

The longitudinal control system was used for evaluating the control characteristics of the 
actuation system. Functional diagrams of the control system are shown in figures 9, 10, and 
34. A fiinrtinniil liisprstn nf fhft sfirntiHaru arfiiatrtc hcpH vr» flip ^tiidv is sb n, v n ,r> r? m > 1 1 

3. 3. 2. 2 Test Results 

The testing performed on the FSAA simulator was divided into two categories. The first 
category evaluated the effects of different control system failure modes on airplane handling 
qualities. The second category investigated the effects of variations of actuator design 
parameters on airplane handling qualities. Each test category was evaluated at the four flight 
conditions described in paragraphs 2.3.1 and 3.3.2. 1 which included operation at landing 
approach and high speed cruise. The airplane configurations were chosen such that the 
handling qualities bordered on the lower limits of normal and minimum safe operation. At 
each combination of airplane configuration and flight condition a test sequence was 
performed with changing actuator characteristics, until clear trends in pilot ratings were 
established. The test procedure is summarized in table 4. 

Figure 35 shows the pilot tasks performed during a typical landing approach test. A similar 
task outline for the cruise condition is shown in figure 36. Each test was evaluated by the 
simulator pilot using the Cooper-Harper rating scale. The Cooper-Harper rating scale is 
shown in figure 37. 

The test results of the FSAA evaluation are contained in tables 1 and 2 and figure 13 
through 25, and are discussed in paragraph 2.3.4. 

3.4 ACTUATION CONCEPT TRADE STUDY 

A quantitative evaluation study was made of both actuator mechanization concepts. An 
analog computer study and an analytical trade study were conducted. The results of these 
studies follow. 

3.4.1 ANALOG SIMULATION EVALUATION 

The analog computer simulation study evaluated the operation and performance character- 
istics of both concepts, and determined the sensitivity of design parameter variations on 
their operation. The purpose ot this study phase was to develop a detailed design definition 
for each system. 

3. 4. 1.1 Configuration Selection 

A computer study was performed using analog models of an active/standby and a force 
summed secondary servo configuration. These analog models included such nonlinearities as 
valve flow and pressure limits, friction, and backlash. 
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Each of the analog models included a representative failure detection network and elements 
required to eliminate or reduce the effects of nonoscillatory failures. 

An oscillatory-failure detection circuit was not included in the analog models. This approach 
was forced, in that especially the force summed model was taxing the analog computer to its 
limits in terms of available computing elements. There were an insufficient number of 
amplifiers to include an oscillatory-failure detection network. 

To minimize distortion of the data the characteristics of each model were kept as near alike 
as possible. For example, the same actuator model (area, friction, flow limit, stroke) was 
used in both models. The load applied to each system was identical in mass, stiffness, and 
damping characteristics. An alternative approach was to increase the actuator size in the 
active/standby system so that the dynamic piston loading would be the same for the two 
systems. This approach would have required estimation of a new set of actuator parameters, 
and would have introduced larger uncertainties to the results than the approach taken. 

The main disadvantage of the approach taken was that the active/standby system 
experienced a larger dynamic piston loading which primarily affected the results of the 
frequency response test data. 

3. 4. 1.1.1 Active/ Standby Configuration Selection.— A. block diagram of the analog model 
used to represent the active/standby secondary actuator is shown in figure 38. The elements 
of one channel are shown in detail, as is the interface with the adjacent channels. Each of 
the adjacent channels is identical to the channel shown. The major elements in each channel 
are the servo amplifier (actuator), electrohydraulic servovalve (actuator), piston dynamics, 
servo amplifier (monitor), and electrohydraulic servovalve (monitor). 

The servo amplifiers and electrohydraulic servovalves of each channel and its monitor are 
identical except as detailed later in this section. 

Each of the three channels of the active/standby system are interfaced through the block 
labeled Load Dynamics. The linkage connecting the secondary actuator to the surface 
actuators is represented as a finite mass with viscous damping and with a low-force gradient 
centering spring. 

The failure-detection logic shown in figure 38 is mechanized so that channel 1 is normally 
the active channel. If channel 1 fails, control is transferred to channel 2 provided that 
channel 2 is operational. If that is not the case, control is transferred to channel 3. 

In the configuration selection process, a single-stage and a two-stage electrohydraulic 
servovalve variant of the active/standby system was tested. 

Figure 39 shows the single-stage variant of the system with its monitor network 
(configuration I). The single-stage valve controls hydraulic flow to the actuator. Differential 
pressure across the actuator piston is sensed for use in the failure monitoring system. The 
valve in the channel monitor operates “blocked port.” The channel monitor’s blocked port 
pressure is sensed and subtracted from the actuator channel pressure to generate an error 
signal. The error signal is tested for amplitude and duration. If it exceeds set limits a 
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failure-detected signal is transmitted to the logic network to activate a standby channel and 
deactivate the failed active channel. 


The channel monitor pressure typically reached maximum system pressure for all but very 
small commands. The actuator differential pressure, except for the initial pulse, only 
reached a fraction of system pressure. Thus, the failure -detection error signal contained very 
little intelligence about the functional state of the channel, as it always was close to system 
pressure whenever the piston was in transition. 


The two-stage valve variant (configuration II) with its monitor network is shown in 
figure 40. The two-stage, electrohydraulic servovalve command input to the first stage 
resulted in a proportional displacement of the second-stage spool. 

Mechanical feedback from the second stage to the first stage torque motor provided this 
proportional control. The displacement of the second stage in turn determined the flow out 
of the unit. 


The first-stage control pressures provided the driving force to position the second-stage 
spool valve. The algebraic sum of the pressure differential in the actuator channel valve and 
in the channel monitor valve should be zero if no failure exists. Representative pressure 
traces in response to a step command is shown in figure 33. Furthermore, since only 
second-stage spool position is monitored, it is not necessary to implement a flow-control 
capability in the monitor channel. For this reason, the second stage of the valve in the 
channel monitor can be simplified. There is no need to include all passages and metering 
devices, as this valve does not control any flow to a downstream actuator. A plain “dummy” 
spool, as shown in figure 33, is adequate. 

Due to normal variations in system gains, etc., the two signals will never be identical. A 
combination of an amplitude threshold and a time delay is used to account for these normal 
variations. It should be noted that these tolerances can be much smaller than those in the 
previously described single stage system. 

A third valve/monitor configuration (configuration III) is shown in figure 41. This one is 
similar to the single-stage configuration shown in figure 39. The only difference is that this 
third configuration has a two-stage valve rather than a single-stage valve. 

A summary of the tests used in selecting the active/standby, valve/monitor configuration is 
shown in table 5. These tests all represent failure conditions and are representative of those 
which the system would be subjected to. 

Figures 42 and 43 summarize the test results for configurations I and II. In evaluating these 
two configurations consideration was given to the magnitude of the output transient 
(AXq/X o max ) due to a failure and to each system’s ability to detect and correct for that 
failure. 

Output transients due to system failures in configurations I and II are compared in 
figure 42. When exposing the active channel to an erroneous ramp command, the output 
followed the command until an error signal had been present in the failure detection logic 
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long enough for the logic to determine that a failure existed. At this time, control was 
transferred to a standby channel. Similarly, if this failure occurred in a monitor channel, the 
logic would detect the failure and transfer control to a standby channel. However, in this 
case there would be no motion of the output. 

A comparison of the performance of the two configurations showed that configuration II 
experienced less of a transient than configuration I. Pressure and time tolerances can be set 
much tighter in configuration 11 than in configuration I, thereby resulting in earlier failure 
detection. 

The high gain failure would typically result from the failure of an amplitude feedback loop. 
When comparing performances for this failure, configuration II proved superior due to the 
tighter tolerances. 

Step failures would result from component failures in the computing elements or drive 
electronics. When comparing system performances to these failures, configuration II showed 
smaller transients for large steps but gradually approached the same performance as 
configuration I as the step amplitudes decreased. During these tests it was found that there 
was a cutoff point in step amplitudes below which the system did not detect a failure due to 
the respective monitor network error signal thresholds. 

System responses to oscillatory failures are compared in figure 43. Oscillatory failures are 
typically generated by the computing elements or drive electronics. The failure detection 
network required to detect oscillatory failures was not modeled on the analog computer. 
The criterion whether or not the system would be able to detect an oscillatory failure was the 
error signal magnitude above the detection threshold. Both configurations displayed the 
same peak amplitudes. However, configuration II had a somewhat greater ability to detect 
failures at higher frequencies. 

Comparing the results of the testing of these two configurations, configuration II perfoms 
better under failure conditions than does configuration I. 

No quantitative testing was conducted on configuration III due to the similarity to 
configuration I. Performance under failure conditions would be similar to configuration I, 
and inferior to configuration II. This conclusion was verified by spot checks. 

As a result of the testing, configuration II was selected as the candidate active/standby 
secondary servo to be compared with the force summed servo. 

3.4. 1.1. 2 Force Summed Configuration Selection.- A. block diagram of the analog model 
used to represent the force summed secondary actuator is shown in Figure 44. One channel 
with its equalization circuit is shown in detail. Three additional channels are tied to the 
common output to make up the redundant control unit. Each of the redundant channels are 
identical to the one channel shown. The major elements of each channel are the servo 
amplifier, electrohydraulic servovalve, piston dynamics, equalization circuit, failure detec- 
tion logic, and centering detent. 
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The four channels are connected in the block labeled load dynamics. This block also 
simulates a representative load consisting of a finite mass with viscous damping and low 
gradient centering spring. In normal operation, all four pistons move in unison, commanded 
by identical command signals. When a failure is detected the failed channel is depressurized 
and a centering detent is engaged. This function is accomplished by the channel disengage 
relays and associated networks. 

The equalization network shown in the diagram (fig. 44) increases the system’s tolerance to 
differences in the four command signals. It is made up of two parallel paths, one integral 
and one proportional. The proportional feedback path in effect reduces the actuator force 
gain, thereby reducing the level of force fight within the system. It is intended to handle 
short term differences in signal levels due to minor gain variations, etc. The integral path is 
intended to reduce the effects of long term differences between the individual command 
signals. This is done by integrating up a “trim signal” that will cancel any steady state bias in 
a command signal. 

Channel failures cause either the pressure feedback signal in the proportional feedback path 
or the trim signal in the integral path to exceed a preselected failure threshold level for a 
preselected time interval. 

A force summed secondary actuator can be designed with a single-stage or a two-stage 
electrohydraulic servovalve (fig. 45.) Assuming that the maximum flow requirement is the 
same regardless of valve type used, the differences between a single-stage and a two-stage 
valve is the pressure gain. To limit the force fight in the system, the proportional pressure 
feedback path is used to reduce the force gain to acceptable levels. With this pressure 
feedback, valve pressure gain has little meaning since the system pressure gain is forced to a 
particular value by the pressure feedback loop. However, if pressure feedback can be 
eliminated by using single stage valves, and if this does not severely impair perfoimance, a 
reduction in cost and complexity would be possible. 

Table 6 summarizes the tests used in the selection of the valve configuration. Six different 
valve pressure gain values were selected and a series of performance tests were conducted 
with each valve configuration. Two of the valve configurations were also selected for 
performance testing under failure conditions, as noted in table 6. 

Figure 46 summarizes the results of the frequency response testing. The observed data 
shows that valve pressure gain variations had little effect on frequency response. There was 
some scatter in data, but no apparent trends. For this reason, envelopes were drawn to 
bound the regions within which the data points were located. 

A summary of transient response testing and resolution testing is shown in figure 47. Valve 
pressure gain affected transient times only when it reached very low values such that the 
initial acceleration was significantly reduced. 

Actuator resolution capability was not affected by variations in valve pressure gain. This 
result was expected as this type of actuator has great acceleration capability and low 
friction. 
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Figure 48 summarizes the test results of the frequency response testing of the force summed 
secondary actuator under failure conditions. Two valve configurations were used in this test 
sequence as noted in table 6. The frequency response characteristics were determined for 
each of the two configurations with all channels operational, with one channel failed and 
with two channels failed. 

The transient response data under failure conditions are summarized in figure 49. Variations 
in pressure gain had only minor effect on actuator performance. Channel failures, on the 
other hand, resulted in considerable performance degradation. This was due in part to the 
fact that the force output of the actuator was reduced by the depressurization of a failed 
channel, and in part to the engagement of centering detent in each failed channel. The force 
capability of this detent amounts to approximately 50% of one channel’s force capability. 
Also, the depressurized channel acts as a viscous damper and generates a considerable 
retarding force as velocity increases. 

The resolution testing is summarized in figure 50. Again, variations in pressure gain had little 
effect on system performance, however hannel failures resulted in a considerable 
performance degradation. Another observation made during the resolution testing was that 
with all channels operating no deadband was noticeable. However, as channels were failed a 
considerable deadband did develop as shown in figure 50. The magnitude of the deadband 
was considerably greater than the magnitude of the hysteresis. 

Figure 51 contains a plot of required pressure feedback versus valve pressure gain to satisfy 
the criteria for interchannel force fight. This plot indicates that the pressure feedback loop 
could be removed if the valve pressure gain is sufficiently low. 

The trend in all valve configuration selection tests was that valve pressure gain had little 
effect on the performance of a force summed secondary actuator with an external pressure 
feedback loop to satisfy a force fight requirement. Only when the valve pressure gain drops 
below values typical for a single-stage servovalve does it cause any performance reduction. 
Therefore, a single-stage servovalve configuration was selected for the force summed 
secondary actuator. This configuration would be used in the performance testing to be 
compared with the active/standby concept. 

In order to make the force summed model directly comparable to the active/standby it was 
also decided to remove the integral feedback path. Thus, the final configuration has neither 
the proportional nor integral pressure feedback paths. It uses the piston differential pressure 
signal for failure monitoring. This signal is evaluated for amplitude and duration to 
determine if a failure condition is present. 

3.4. 1.2 Normal Operation Performance Evaluation 

The active/standby and force summed systems, as described in paragraph 3.4. 1.1, with 
nominal valued parameters, shown in table 7, and without failures were considered to be the 
normal systems. Normal performance characteristics were determined for both actuator 
configurations on an analog computer. The normal performance testing provided baseline 
frequency response, transient response, and resolution data for overall system evaluation. 
Table 8 presents a summary of the test procedures used for the testing. 
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3.4.1. 2.1 Ac five /Standby Test Results.— The active /standby frequency response character- 
istics under normal conditions is shown on the Bode plot of figure 52. The system 
amplitude response showed slight peaking between 0.4 Hz and 5 Hz. The amplitude 
response started to roll off at 5 Hz, and at 8.5 Hz and -3 dB, and at 40 Hz was -35 dB. The 
system phase lag data showed a slight phase lag at 0.1 Hz, and 45° phase lag at 3.5 Hz, and a 
90° phase lag at 7 Hz. 

The system transient test showed a transition time of 0.7 second. The transition time 
corresponds to an output rate of 0.033 m/sec (1.3 in./sec) which is equivalent to the control 
valve saturated flow rate. 

Figure 53 shows an X-Y plot of the normal system steady state output position versus input 
command. The largest hysteresis loss, 4% (f.s.), occurred near the null position. The 
hysteresis losses are attributed to friction, backlash, and system tolerances. 

3. 4. 1.2. 2 Force Summed Test Results.— The force summed frequency response data 
characteristic under normal conditions is shown on the Bode plot of figure 54. The system 
amplitude response showed a slight peaking between 0.4 Hz and 5 Hz. The amplitude 
response started to roll off at 5 Hz and at 13.5 Hz was -3 dB, and at 40 Hz was -9 dB. The 
phase lag was slight at 0.1 Hz, 45° at 6.0 Hz, and 90° at 18 Hz 

The system transient response test showed a transition time of 0.7 sec. This transition time 
corresponds to an output rate of 0.033 m/sec (1.3 in /sec), which is equivalent to the 
control valve saturated flow rate. 

Figure 55 shows an X-Y plot of the normal system steady state output position versus input 
command. The largest hysteresis loss, 3% (f.s.) occurs near the null position. The hysteresis 
losses are attributed to friction, backlash, and system tolerances. 

3. 4. 1.3 Parameter Sensitivity Evaluation 

The active/standby and the force summed systems, as described in paragraph 3. 4. 1.1 were 
evaluated as to their sensitivity to certain design parameters. 

Both actuator configurations were modeled on an analog computer where specific tests were 
conducted to determine the effects of the parameter variations. Frequency response, 
transient response, and resolution response tests were conducted. Table 8 presents a 
summary of the test procedures used for the testing. 

3.4. 1.3.1 Active/ Standby Test Results.— Table 9 is a list of the study parameters and their 
variations. The test data showed the active/standby configuration to be sensitive to certain 
parameters. The following discusses the active/standby system sensitivity to the study 
parameters. A summary of the most significant data is shown in table 10. 

Pressure Gain: The pressure gain parameter, Kp, was varied from 13.8 x 106 Pa/m A to 13.8 
x 10? Pa/mA (2000 psi/mA to 20000 psi/mA). The nominal Kp was 6.9 x 107 Pa/mA 
(10000 psi/mA). The system performance (frequency response, transient response, and 
resolution) was not noticeably affected by these Kp variations. 
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Flow Gain: The flow gain, K v , was varied from 3.3 x 10 - 7 m3. mA/s to 9.9 x 10-7 
m3 • mA/s (0.02 in3 • mA/s to 0.06 in3 * mA/s). The nominal Ky was 6.5 x 10-7 m3. mA/s 
(0.04 in3 * mA/s). 

The active/standby system dynamic response showed K v dependence for small sinusoidal 
command signals (±5%F.S.), (fig. 56). The -3 dB cutoff frequency varied from 5 Hz to 
10 Hz. The frequency response (for small command signals) is directly related to a change in 
K v since a small sinusoidal command signal does not flow-saturate the control valve. For 
larger command signals, where the control valve would become flow saturated, there would 
be no Ky dependence. 

The active/standby system transient response was not sensitive to Ky variations within the 
tested limits. 

Active/standby resolution data showed that the system output hysteresis varied from 6% 
(f.s.) for a K v of 3.3 x 10-7 m 3 . m A/s (0.02 in3 . mA/s) to 4% (f.s.) to a K v of 9.9 x 10-7 
m3 • mA/s (0.06 in3 • mA/s) (fig. 57). 

Flow Limit: The control valve flow limit, Ql was varied from the nominal flow limit of 
6.5 x 10"6 m3/s to 1.6 x 10-5 m^/s (0.395 in3/s to 0.955 in3/s). The actuator transient 
response characteristics showed a decrease in response time for an increased Ql (fig. 58). 
The transition time decreased linearly from 0.7 sec* to 0.3 sec for an equivalent 
proportionate increase in Ql- No other active/standby performance characteristics were 
noticeably affected. 

Backlash: The system backlash, B, was varied from the normal backlash of 5.1 x 10-5 m to 
2.54 x 10 4m (0.002 in. to 0.010 in.). The system frequency response (due to ± 5% f.s. 
sinusoidal command) data and resolution data showed B dependence. Transient response 
tests were not conducted for B variations, because they do not effect the output rate (i.e., 
transition time). 

The -3dB cutoff frequency varied from 8.5 Hz to 10.5 Hz for the extreme B values. The 45 
phase lag frequency was 3.5 Hz and 1 .7 Hz for the same B variation (fig. 59). The amplitude 
response data increased in amplitude output as B increased. An explanation is that when the 
actuator reached the commanded position, the system inertia coupled with an increased B 
allowed the actuator output to overshoot the commanded position. The increased phase lag 
as B increased was due to the lost motion. That is, position output would neither start nor 
stop moving in the commanded direction until the actuator output traveled the backlash 
distance. 

Resolution data showed hysteresis losses of 4% (f.s.) and 8% (f.s.) for B equal to 
5.1 x 10-5 m and 2.54 x 10^ m (0.002 in. and 0.010 in.), respectively (fig. 60). This is due 
to the lost motion in the output. 


*The transition time of 0.7 sec is the time for the system to respond to a 90% command, see table 10. 
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Friction: The system friction, F, was varied from 1.8 N to 89 N (0.4 lbf to 20 lbf) with a 
nominal F of 1 .8 N (0.4 lbf). 

System frequency response data showed that the -3 dB cutoff frequency varied from 8.5 Hz 
to 3.5 Hz for F equal to 1.8 N and 35.6 N (0.4 lbf and 8 lbf), respectively. The 45° phase lag 
frequency varied from 3.5 Hz to 1.5 Hz for those same F values (fig. 61). 

Transient response data showed F dependence. The system transition time varied from 
0.7 sec* to 1 .1 sec for F equal to 1.8 N and 89 N, respectively (fig. 62). 

Resolution data showed that the system hysteresis varied from 4% to 12% (f.s.) for the 
nominal configuration and F of 89 N (20 lbf), respectively (fig. 63). 

For any friction type output load, a certain equivalent input command is required to 
generate sufficient actuator output force to overcome the friction restraint and cause the 
output to respond (i.e., move). This command level is therefore effectively lost and reflected 
as degraded frequency response, degraded transient response, and increased hysteresis loss. 

Damping: The damping parameter, D, was varied from 1059 N »s/m to 1750 N • s/m 
(6 lbf • s/in. to 10 lbf • s/in.). The nominal D was 1400 N s/m (8 lbf • s/in.). The system 
transient response data were not noticeably affected by these D changes. The frequency 
response data showed slight D dependence (fig. 64). Resolution tests were not conducted 
since D is a velocity dependent parameter and resolution tests are conducted in a manner 
to minimize such velocity effects. 

Actuator Rod Stiffness: The actuator rod stiffness, K s was varied from 2.6 x 10^ N/m to 

4.4 x 106 N/m (15 000 Ibf/in. to 25 000 lbf/in.). Variations of K s only slightly affected the 
system frequency response (fig. 65). Transient response and resolution tests were not 
conducted for variations of the rod stiffness. 

Actuator Dynamic Stiffness: The actuator dynamic stiffness, K, was varied from 

1.5 x lO^N/m to 2.4 x 106 N/m (8500 lbf/in. to 13 500 lbf/in.), with a nominal K of 
1.9 x 106 N/m (1 1 000 lbf/in.). None of the system performance characteristics (frequency 
response, transient response, and resolution) were sensitive to changes of K. 

3.4. 1.3. 2 Force Summed Test Results .— Table 11 is a list of the study parameters and the 
parameter values utilized to determine the force summed performance characteristics. A 
summary of the most significant data is shown in table 12. Test data showed the force 
summed system to be sensitive to certain parameter variations. These are discussed below. 

Flow Gain: The flow gain, K v , was varied from 3.3 x 10 _ 7 m3 . mA/s to 9.9 x 10‘7 
m3. s/mA (0.02 in3 • mA/s to 0.06 in3« mA/s). The nominal K v was 6.5 x 10"7 m3 » s/mA 
(0.04 in3 * mA/s. Changes in K v affected both frequency response and resolution data, but 
did not noticeably affect the transient response data. 


transition time of 0.7 sec is the time for the system to respond to a 90% command, see table 10. 
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The -3 dB cutoff frequency varied from 7.5 Hz to 18 Hz (fig. 66) for the extreme Ky values. 
The 45 cutoff frequency was 4.0 Hz and 8 Hz for the same extreme Ky values. The 
frequency response for small command signals of this system is directly related to a change 
in Ky, since a ±5% sinusoidal command signal does not flow-saturate the control valve. 
Whenever the control valve is operating in a flow saturated region (i.e., large commands), 
there will be no K v dependence. 

Resolution data showed that the system output hysteresis, figure 67, varied from 5% (f.s.) 
to 2% (f.s.) for Ky equal to 3.3 x 10 _ 7 m3 ♦ mA/s and 9.9 x 10-7 m3 • mA/s (0.02 in3 - mA/s 
and 0.06 in3 • mA/s, respectively. 

Flow Limit: The flow limit, Ql, was varied from the nominal Ql of 0.65 x 10" 5 m3/s to 

1.6 x 10'5m3/s (0.395 in3/s to 0.955 in3/s). Frequency response data showed no Ql 
sensitivity, because the control valve was not flow saturated for any of the flow limit 
testing. Tire transient response characteristics showed that the actuator transition time* 
varied from 0.7 sec to 0.3 sec for Ql equal to 0.65 x 10-5 m3/s and 1.6 x 10-5 m 3/s 
(0.395 in3/s and 0.955 in3/s), respectively. 

Backlash: The system backlash, B, was varied from the nominal value 5.1 x 1 0~5 m to 
2.54 x 10-4 m (0.002 in. to 0.010 in.). 

The frequency response data showed B dependence (fig. 68). The -3 dB cutoff frequency 
varied from 13.5 Hz to 20 Hz for the extreme B values. The 45° cutoff frequency was 
6.0 Hz and 3.0 Hz for those same B values. The increased amplitude response may be due to 
the system inertia coupled with backlash allowing the actuator to overshoot and cause an 
apparent improvement in the amplitude response data. The phase lag degradation with 
respect to increased B is due to lost motion. 

The force summed system resolution data showed no B dependence (fig. 69). The reason is 
that the four channels are force fighting one another in such a way to preload the system, 
and effectively eliminate any backlash effects. Thus, the changes that are made in B, would 
not be apparent whenever the system was operated in a nearly steady-state mode (i.e., 
during the resolution testing). 

Friction: The force summed system friction, F, was varied from 1.8 N to 89 N (0.4 lbf to 
20 lbf), with a nominal F of 1.8 N (0.4 lbf). The system performance (frequency response, 
transient response, and resolution) showed no F dependency for friction values less than 

35.6 N (8 lbf). Frequency response data showed that some performance degradation 
occurred for a friction value of 89 N (20 lbf) (fig. 70). 

Damping: The damping parameter, D, was varied from 1050 N- s/m to 1750 N • s/m 
(6 lbf • s/in. to 10 lbf ■ s/in.), and the nominal D was 1400 N * s/m (8 lbf - s/in.). System 
transient response data was only slightly affected by D variations. This slightly-observed 
effect was assumed to be within experimental data tolerances. 


*The transition time of 0.7 sec is the time for the system to respond to a 90% command, see table 12. 
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Actuator Rod Stiffness: The actuator rod spring, Ks, was varied from 2.6 x lO^N/m to 

4.4 x 106 N/m (15 000 lbf/in. to 25 000 lbf/in.), with a nominal K s equal to 3.5 x 1C)6 N/m 
(20 000 lbf/in.). Variations of Ks did not noticeably affect the system frequency response. 
The rod spring was not varied for either the transient response or the resolution test 
procedures. 

Actuator Dynamic Stiffness: The actuator dynamic stiffness, K, was varied from 

1.5 x !06 N/m to 2.4 x 106 N/m (8500 lbf/in. to 13 500 lbf/in.), with a nominal K of 
1.9 x 106 N/m (1 1 000 lbf/in.). None of the system performance characteristics (frequency 
response, transient response, and resolution) were sensitive to the tested K variations. 

Voltage Offset: The voltage offset, Av, was varied from 0 (zero) % to ±2.5% of the full 
scale command, with a nominal A v of 0%. The system frequency response, transient 
response, and resolution tests showed no effect due to Av under normal conditions. 

3. 4. 1.4 Failure Effects Evaluation 

Failure tests were conducted on the active/standby and force summed actuator configura- 
tions to show how the respective output transients vary due to different failure types (i.e., 
slowover, step, oscillatory, passive, and high gain). For all failure conditions, except for the 
slowover failure, the system parameters were kept at their nominal value. The slowover 
failure testing was conducted with parameter variations to show this effect on output 
performance. The slowover testing was conducted by varying critical design parameters 
separately and independently of the others and then introducing a slowover failure. Typical 
actuator failure response characteristics are shown on figures 7 1 through 74. 

3.4. 1.4.1 Active/Standby Test Results 

3.4. 1.4 A Active (Standby Test Results: A block diagram of the active/standby system is 
shown in figure 7 to facilitate the discussion of failure types and failure test procedures 
peculiar to the active/standby concept. The active/standby system as tested includes a 
failure monitoring concept as described in paragraph 3.4. 1.1. Although certain oscillatory 
failure conditions were detectable as slowovers, no failure logic was implemented 
specifically to detect oscillatory failures. The failure monitor system is not an optimized 
configuration. However, the configuration is suitable for comparing the relative character- 
istics of the two actuator concepts being studied. 

Failure Definition and Test Procedure: The following discussion defines the types of 
failures and the test procedure used in determining the effects of, and sensitivity to certain 
failure conditions. 

A slowover failure is an erroneous signal in the form of a ramp input command to one or 
more of the six active/standby channels. Tests were conducted by introducing a ramp 
command signal into channel A c (fig. 7). All other channels had no input commands. In 
addition to determining the nominal system transient behavior due to a slowover failure, 
certain specific design parameters were independently varied to determine the failure 
sensitivity to parameter variations. 
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An oscillatory failure is an erroneous signal in the form of a periodic input command (e.g., 
sinusoidal) into one or more of the six active/standby channels. To determine the effect of 
oscillatory failures, a sinusoidal command was introduced into channel Ac (fig. 7). Ail other 
channels had no input commands. 

A step failure is an erroneous signal in the form of a step input command to one or more of 
the six active/standby channels. Tests were conducted by introducing a step command signal 
into channel Ac (fig. 7). All other channels had no input commands. 

A high gain failure is a failure condition caused by an open feedback in one of the six 
active/standby channels. Consequently, no output position information is being fed back to 
compare (algebraically sum) with the input command, and consequently a very small input 
signal would cause the high gain actuator output to fully extend (or retract). Tests were 
conducted by opening the feedback path of channel A c (fig. 7) and introducing a ramp 
command into all channels. 

A passive failure is a failure condition caused by an open circuit in the input signal path to 
one or more of the six active/standby channels. The result is that no input commands are 
available to the affected channel. A feedback signal was available as an input error signal. 
Tests were conducted by opening the signal path to channel A c (fig. 7) and introducing a 
ramp command into all channels. 

Failure Sensitivity— Slo wo ver: Table 13 summarizes the output transient (due to a slowover 
failure) sensitivity to parameter variations, as per table 9. 

With the exception of Backlash and friction, none of the study parameter variations 
noticeably altered the slowover failure output transient of ± 5 % (f.s.). For Backlash values of 
5.1 x 10 - 5 m and 2.54 x 10-4 m (0.002 in. to 0.010 in.) to failure transient was ±5% and 
±8% (f.s.), respectively (fig. 75). Backlash, B, represents mechanical slop in the system. 
Thus, whenever a slowover failure is detected, the active channel would become disengaged 
and control switched to a standby channel. The output would then be driven to the position 
commanded by the activated standby channel. Under these conditions, the system inertia 
coupled with backlash would result in an overshoot within the limits of the backlash. Thus, 
the greater the backlash, the greater the overshoot. 

The most significant output transients were shown to occur whenever a channel failure was 
coupled with a position offset of a standby channel (table 14). The reason is that upon 
failure, a standby channel becomes active, and the position output will be commanded to a 
new null position (i.e., position offset), different from the old null position. 

Failure Sensitivity-Oscillatory, Step, High Gain, and Passive: Tables 15 and 16 summarize 
the oscillatory, step, and high gain, and passive failure output transient data, respectively. In 
general (exceptions were the passive failure and high gain), the output would follow a failure 
command up to the failure detection threshold level. At this level, the failure monitor would 
disengage the erroneous channel. The output would then move (viz. transient) to the 
position commanded by the newly activated standby channel. If either the active channel or 
the activated standby channel was offset from the actual (correct) command signal, a larger 
(or smaller) output transient could be expected. 
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Output transient characteristics were determined for the oscillatory failure condition with 
no specific oscillatory failure logic incorporated into the failure monitor system. However, 
very low frequency oscillatory failures were detected as a slowover failure. The 0.1 Hz and 
1 Hz sinusoidal oscillatory failures of ±10% command level amplitude were detected as 
slowover failures. The higher frequency (e.g., 10 Hz) oscillatory failures showed output 
transient, amplitudes to be reduced (as compared to lower frequency) because of the system 
frequency response characteristics (table 15). A channel failure was not detected for the 
±10%, 10 Hz signal because the time delay trip level of the failure monitor was set too long. 
That is, the failure detect signal amplitude was greater than the failure threshold for a period 
that was shorter than the failure detect time delay. 

The output transient characteristics for step failures were predictable. The output transient 
for a 1% step (f.s.) and no voltage offsets was about 1.5%. Backlash in the actuator model 
affected the output transient amplitude, particularly at the lower level step commands. The 
output transient for a 10% step (f.s.) under similar conditions was 10%. Table 16 
summarizes the step failure data. When offset commands were introduced among channels, 
an asymmetric output transient occurred. The noted asymmetry difference was because the 
offset would either add to or subtract from the output transient depending on the sense at 
the time of failure detection and switching. 

Output transients for the high gain failure ranged from 3% (f.s.) to 10% (f.s.) for conditions 
of zero offset and 2.5% offset of the standby channel, respectively (table 1 7). 

The output transients for the passive failure condition ranged from 3% (f.s.) to 8% (f.s.) for 
a zero offset and a 2.5% offset of the standby channel, respectively (table 17). 

Failure Sensitivity— Performance Degradation: In an active/standby system, the control 
channels operate independently with only one channel controlling at a time. There is no 
force (or load) sharing among channels, and failure of an active channel causes transfer to a 
correctly operating standby channel with no subsequent performance degradation. 

3.4. 1.4.2 Force Summed Test Results .— A block diagram of the force summed system is 
shown in figure 8 to facilitate the discussion of failure types and failure test procedures. The 
force summed system, as tested, utilized a failure monitoring system as described in 
paragraph 3. 4. 1.1. Although not optimized, this failure monitoring system is suitable for 
comparative evaluation with the active/standby system. 

Failure Definition and Test Procedure: The following discussion defines the types of 
failures and the test procedure used in determining the effects of, and sensitivity to certain 
failure conditions. 

A slowover failure is an erroneous signal into one or more of the four force summed channel 
(fig. 8). Tests were conducted by introducing a ramp command signal into channel A. All 
other channels received only feedback information and consequently these channels 
opposed any action by channel A. In addition to determining the transient behavior of the 
nominal actuator design due to a slowover failure, certain design parameters, table 1 1, were 
varied to show the system failure sensitivity to parameter variations. 
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An oscillatory failure is an erroneous periodic signal (e.g., sinusoidal) into one or more of 
the four force summed channels (fig. 8). These tests were conducted by introducing a 
sinusoidal command into channel A. All other channels received only feedback information 
and consequently these channels opposed any action by channel A. 

A step failure is an erroneous signal in the form of a step input command into one or more 
of the four force summed channels (fig. 5). Tests were conducted by introducing a step 
input into channel A. All other channels received only feedback infonnation and 
consequently these channels resisted any action by channel A. 

A high gain failure results from an open feedback in one or more of the four force summed 
channels. Consequently no position output information is available for (algebraic sum) 
comparison with the input command. Thus, a very small input would command the high 
gain actuator to fully extend (or retract). Tests were conducted by opening the position 
feedback to channel A (fig. 8), then introducing a ramp into all four channels. 

A passive failure is caused by opening the input command path to one or more of the four 
force summed channels. Tests were conducted by opening the input command path to 
channel A (fig. 8) then introducing a ramp into all four channels. As a result, channel A 
receives only feedback information and opposes any action of the other three channels. 

Failure Sensitivity— Slowover: Table 18 summarizes the slowover failure transients and 
transient sensitivity to parameter variations, as per table 1 1 . 

Backlash, B, affected the system failure output transient. The output transient varied from 
1.8% (f.s.) to 2.4% for B values of 5.1 x 10" 5 rn to 2.54 x 10“4 m (0.002 in. to 0.010 in.), 
figure 76. Whenever the failure was detected as a failure and the respective channel 
disengaged, the output rapidly repositioned to the commanded position by the remaining 
operable channels. The system inertia coupled with backlash caused the actuator output to 
overshoot the commanded position. The amount of overshoot (transient) was dependent on 
the amount of backlash. 

Increased friction caused a decreased failure transient. Friction absorbed energy from the 
system and acted as coulomb damping. Consequently, increased friction caused a decreased 
output failure transient. 

Failure Sensitivity— Oscillatory, Step, High Gain, and Passive: Tables 19, 20, and 21 
summarize the oscillatory, step, high gain, and passive failure output transient data. For 
each of the failure conditions, test data showed that the system output tended to follow the 
failure command signal at a reduced level because of interchannel force fight. 

There was no oscillatory failure logic incorporated into this system. However, very low 
frequency oscillatory failures were detected as a slowover failure. The 10 Hz output 
transients showed a large amplitude reduction (larger than 0.1 Hz or 1.0 Hz) (table 19) 
because of the frequency response characteristics of the system. Position offsets had little 
effect on the magnitude of the oscillatory' output transients, since no channels disengaged 
for the tested oscillatory failure inputs. Furthermore, whenever an oscillatory failure was 
introduced into the system with one disengaged channel, the oscillatory output transients 
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were of similar magnitude to the transients of a fully operative system. The reason was that 
the centering detent spring, which engaged as channel disengagement occurred, provided a 
load that opposed the oscillatory failure transient. Thus no increased failure transient with 
respect to channel disengagement was produced. 

Step failure data (table 20) showed an attenuated position output, because of interchannel 
force fight The ±10% (f.s.) step commands were not large enough to cause channel 
disengagement. 

High gain failure output transients (table 21 ) were about 2.3% (f.s.). Any position of voltage 
offset caused the high gain actuator to move at the maximum velocity until a channel failure 
was detected. The large output transient was due to the finite time delay, which was 
incorporated into the failure detection logic. 

The passive failure output transient (table 21) ranged to 1.2% (f.s.). The passive channel 
tended to resist the actuator commanded movement, since the feedback signal provided a 
negative command to the passive channel. The passive failure only prevented an input 
command, not a feedback error signal, from controlling the passive channel. Upon channel 
disengagement, the resistance due to the passive channel was eliminated and the system 
drove toward the commanded position. However, the centering detent force engagement 
replaced the resistive force of the disengaged channel. Consequently, the observed output 
transient was proportional to the difference between the centering detent force and the 
force that was produced by the passive channel failure at the moment of channel 
disengagement. 

Failure Sensitivity-Performance Degradation : Load sharing is a characteristic of the force 
summed system, and the loading on each channel is dependent upon the loading on the 
other channels. Consequently, whenever a channel failure and disengagement occurs, the 
operable channels must share the load which was previously carried by the disengaged 
channel. Furthermore, a centering detent load is engaged upon channel disengagement 
which always tends to force the position output toward null (center position). Thus, upon 
channel disengagement, the remaining operable channels must also carry the load of the 
centering detent. As a result of this load sharing characteristic, system performance 
degradation was observable upon channel disengagement. 

Table 22 summarizes the observed performance degradation due to channel failures. All 
aspects of the system performance (frequency response, transient response, and resolution) 
showed degradation. 

The system frequency response to a ±5% (f.s.), 0.01 Hz sinusoidal command was used as the 
basis for comparing steady state response characteristics following failures. The steady state 
output responses was 5%, 4%, and 2.5% for zero, one, and two channel disengagement, 
respectively. The -3 dB cutoff frequency also showed degradation (fig. 77). 

The system hysteresis losses were 3%, 4%, and 6% (f.s.) for the zero, one, and two channel 
disengagement (fig. 78). These three plots also show an output versus input gain reduction 
about null for one and two channel failures. The reason for this attenuated output about 
null was that the additional system centering detent loads (added as channels are 
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disengaged) absorbed some of the system force capability. However, when the actuators 
overcame the maximum detent force level, the output to input gain returned to the normal 
(no load) gain (fig. 78). Although the gain returned to normal, the output position had been 
reduced. 

3.4.2 ANALYTICAL EVALUATION 

The analytical trade studies compared the two actuator concepts relative to safety 
reliability, malfunction reliability, survivability /vulnerability, and system implementation. 
The purpose of this study was to compare the two concepts relative to these criteria. 

3.4.2. 1 Safety/Maintenance Reliability 

There are two general reliability requirements that the flight control system and its 
actuation components must meet. These are the mean time between noncritical failures and 
the mean time between catastrophic failures. The MTBF/noncritical is a maintenance 
indicator. The MTBF/catas trophic is an indicator of the overall operational reliability of the 
airplane. The MTBF/noncritical, if too short, may cause an unacceptable frequency of 
dispatch delays or spending a disproportionate amount of time on maintenance compared to 
flying time. The MTBF/catastrophic indicates the probability of safely completing a flight 
without catastrophe due to airplane system failures. The general effect of applying 
redundancy to a flight control system is to improve the catastrophic MTBF value and 
degrade the noncritical MTBF value. 

System reliability can be calculated from a success path diagram. Assume a redundant 
channel electronic system with perfect channel processor circuitry that always votes out 
erroneous electronic signals, monitors electronic failures, and isolates failures from 
redundant electronic channels. Also, assume a perfect actuator failure detection and 
correction logic circuitry. The success path diagrams for both the active/standby and force 
summed configurations could be drawn as shown in figure 79. Let A a be the failure rate of a 
single actuator channel which includes the failure rates of all components in the channel 
plus hydraulic power. Let Am be the failure rate of- a single monitor (model) channel which 
includes the failure rates of all components in that channel. 

Active/Standby: In the three-chamel active/standby system, one channel (actuator plus 
monitor) is required to ensure a good output or a fail-passive last failure. The reliability of 
the system can be calculated as follows. The probability of a channel failing in any one 
flight is approximately *A c t where t is flight time. The probability of n channels failing 
would be (A c t) n ; where A q is the sum of A A and Am- Therefore: 

^ active/standby “ ^A + A m ) ^ 


Force Summed: In the four-channel force summed system, two operating channels are 
required to ensure a good output or a fail-passive last failure. The probability of n channels 
failing, as before, would be (A c t)n. The probability of the system failing can be computed 


♦Probability of failure = 1 - e'^ and when At is small: 1 -e"^ as At 
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by summing the probabilities of all the mutually exclusive ways it could fail. An n channel 
system could fail by having any combination of n-1 channels fail or by having n channels 
fail. The probability of n-1 channels failing is (Act) 11 ' 1 - There are n mutually exclusive 
combinations for having n-1 channels of an n channel system fail. Thus, the probability of 
an n channel system failing would be: 


^force summed n (^ c t ) n * + (\0 n 

since Act is much smaller than 0.1 for any practical system, a satisfactory approximation is: 

n-1 

^ force summed “ n (\T) 

= 4(A A t) 3 

Conclusions: With the above derived probabilities for system failures, and assuming that 
= X servo + Miyd is the same for both concepts, and that X m = X servo , the following can 
be derived: 


X A/S = (\ervo +X hyd + X m> 3 * 3 
X FS “ ^servo + x hycP 3 * 3 

Let: 


X ser vo = 25 x 10‘^ failures/hour 
X hyd = 250 x 10~ 6 failures/hour 
X m - 25 x 10'^ failures/hour 

Then the data of table 23 can be calculated. Figure 80 shows the relationship of total 
system loss versus duration of flight for both the active/standby and force summed systems. 

The number of hydraulic systems used, as well as the failure rate of hydraulic systems 
relative to other component failure rates has a significant effect on the reliability results. 
The active/standby, three-channel system is assumed to use three hydraulic systems, whereas 
the four-channel, force summed system naturally uses four hydraulic systems. This fact, in 
itself, tends to reduce the relative reliability of the force summed system, i.e., the 
probability of losing any three hydraulic systems out of four is greater than losing all three 
out of only three. 

During the Boeing/US SST development, it had been established that an “extremely 
remote failure probability classification would be equal to or less than one failure in 109 
flight hours. “Extremely remote” failures are those which, although theoretically possible, 
would not be expected to occur in the life of an SST fleet. 

The reliability calculation of the two actuation concepts of this study are within this range. 
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3 .4.2.2 Survivability/Vulnerability 

Because the entire secondary actuator, cylinders, control valves, and summing mechanism 
can be considered vulnerable, it is assumed that protection would be provided to preserve 
the integrity of the system in a hostile environment. In-flight damage could result from 
gunfire, noncatastrophic midair collision, engine burst, tire burst, etc. Since both actuator 
concepts are approximately the same size, the penalty for protection would be about the 
same (e.g., if by armor protection). 

The vulnerability of hydraulic systems is a significant concern in configurating systems. With 
the triple-channel, active/standby system only three hydraulic systems are used; therefore, 
only three hydraulic systems are exposed to a common damaging occurrence. Whereas, with 
the four-channel, summed system which uses four hydraulic systems, the exposure is greater 
and the vulnerability of the total airplane system could be more severe. Due to this 
vulnerability, the force summed system is rated less desirable than the active/standby system 
in terms of survivability. 

3. 4. 2. 3 System Implementation 

Pro ducibility Both concepts are ranked the same in producibility, i.e., manufacturing and 
quality assurance. Although somewhat different, neither concept requires any specialized, 
unique hardware or equipment requiring expensive development of special manufacturing 
techniques. 

Weight.- A weight comparison shows the active/standby actuator system has an advantage 
over the force summed system. The major difference is due to the number of actuator 
channels required for each concept; three for the active/standby versus four for the force 
summed. With a single actuator channel weight of 2.27 kg (5 lb), and an output summing 
mechanism weight of 4.54 kg (101b) for the force summed and 3.63 kg (8 1b) for the 
active/standby, then the following weight summation results: 

Total actuator 
weight 

Active/standby 10.5 kg (23 lb) 

Force summed 13.6 kg (30 lb) 

Cost .— The cost breakdown for the two concepts is based on a qualitative comparison since 
actual costs were not determined. To rate the systems, it is assumed that in the force 
summed system, each actuator channel costs a specific amount as does the summing 
mechanism. Then, for the active/standby system, since each channel is the same as a force 
summed channel, plus a monitor (essentially an electrohydraulic servo valve), each channel 
would cost about 1.2 times the amount. The active/Standby output summing mechanism 
cost is about 0.75 times the force summing mechanism. Therefore, the following cost 
comparison can be calculated. 
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Force summed 


4X + . 
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4X + X = 5X 

/ 

Summing mechanism 
Actuators 
Active/standby 


3(1. 2X) + 0.75X = 4.4X 

/ > 


Summing mechanism 
^Actuators 

Therefore, the active/standby system costs approximately 0.9 of the force summed system. 
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Figure 32.— Summary of Airplane Configuration Characteristics— Landing Approach 



Figure 33.— Summary of Airplane Configuration Characteristics— Cruise (M-2.7) 
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Figure 34.— Longitudinal Control System Functional Description 
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PI LOT TASK 


Landing approach and touchdown 

Check: 

• Pitch SAS on 

• Roll SAS off 

• Yaw SAS on 

• Autothrottle engage 

• Noise on 

• IAS 144 knots 

• Altitude 1800 ft 

• IVSI 0 ft/min 
Perform the following tasks: 

• Maintaining constant altitude, capture localizer 

• Flying the localizer, capture glideslope 

• After stabilizing on localizer and glideslope, deviate one dot above glideslope and stabilize 

• Recapture glideslope 

• Continue landing to nose-wheel touchdown. 

Figure 35. —Sample Pilot Task Description— Landing Approach 


PRECEDING 
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PILOT TASK 


High-speed cruise maneuvering 


Check: 

• Pitch SAS on 

• Roll SAS on 

• Yaw SAS on 

• Throttles synchronized 

• Noise on 

• Mach number reading 2.7 

• IAS 567 knots 

• Altitude 60,000 ft 

• IVS1 0 ft/min 

Starting from stabilized level flight condition conduct the following: altitude, airspeed, and heading 
changes in sequence. Trim airplane for straight and level flight after each maneuver. 

Altitude variations: 

• Climb to 60,250 ft at 500 ft/min 

• Descend to 59,500 ft at 1 000 ft/min 

• Climb to 60,500 ft at 2000 ft/min 

• Descend to 60,000 ft at 500 ft/min 
Airspeed variations: 

• Increase indicated airspeed to 587 knots 

• Decrease indicated airspeed to 547 knots 

• Increase indicated airspeed to 567 knots 
Heading changes: 

• Turn to a heading of 105 degrees — 15 degree bank 

• Turn to a heading of 080 degrees — 30 degree bank 


Figure 36.— Sample Pilot Task Description-Cruise 
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HANDLING QUALITIES RATING SCALE 


ADEQUACY FOR SELECTED TASK Oft 
REQUIRED OPERATION 4 


" Is It v 

sat.sfactory without 
v improvement? - 


j/' tsadequate^v 
performance 

Attainable with a tolerable^ 
pitot workload? / 


No | Deficiencies 
► worrant 
I improvement 


No | Deficiencies 
fc require 
t improvement 


AIRCRAFT 
• CHARACTERISTICS 


DEMANDS ON THE PILOT 
IN SELECTED TASK OR REQUIRED OPERATION 4 


Excellent 

Pilot eompensalion not a factor for 

Highly desirable 

desired performance 

Good 

Pilot compensation not a tactor for 

Negligible deficiencies 

desired performance 

Fair — Some mildly 

Minimal pitot compensation required for 

unpleasant deficiencies 

desired performance 


Minor but annoying 

Desired performance requires moderate 

deficiencies 

pilot compensation 

Moderately objectionable 

Adequate perl Orman ce requires 

deficiencies 

considerable pilot compensation 

Very objectionable but 

Adequate performance requires extensive 

tolerable deficiencies 

pilot compensation 



Adequate performance not attainable with 

Major deficiencies 

maximum tolerable pilot compensation. 


Controllability not in question 

Major deficiencies 

Considerable pilot compensation is required 
tor control 

Major deficiencies 

Intense pitot compensation is required to 
• retain control 


Improvement 

mandatory 


Major deficiencies 


Control will be tost during some portion o! 
required operation 


Cooper-Harper Ref, NASA TND-S t SO 


* Definition of required operation involves designation ol flight phase md/or 
tubphasea eith accompanying conditions. 


DEFINITIONS FROM TN-D-5153 


COMPENSATION 

The measure of additional pilot effort 
and attention required to maintain a 
given level of performance in the face of 
deficient vehicle characteristics. 

HANDLING QUALITIES 

Those qualities or characteristics of an 
aircraft that govern the ease and preci- 
sion with which a pilot is able to perform 
the tasks required in support of an air- 
craft role. 

MISSION 

The composite of pilot-vehicle functions 
that must be performed to fulfill opera- 
tional requirements. May be specified for 
8 role, complete flight, flight phase, or 
flight subphase. 


PERFORMANCE 

The precision of control with respect to 
aircraft movement that a pilot is able to 
achieve in performing a task. (Pilot- 
vehicle performance is a measure of 
handling performance. Pilot perform- 
ance is a measure of the manner or 
efficiency with which a pilot moves the 
principal controls in performing a task.) 

ROLE 

The function or purpose that defines the 
primary use of an aircraft. * 

TASK 

The actual work assigned a pilot to be 
performed in completion of or as repre- 
sentative of a designated flight segment. 


WORKLOAD 

The integrated physical and mental effort required 
to perform a specified piloting task. 
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Figure 41 .—Active /Standby Configuration /// Monitor Schematic 


95 










Failure 

detected 

Failure not 
detected 




p>*w**2v v*’ 

* ♦V-. %T- ♦ * ♦- ^ 


Vi* •* V 




♦w« 




Config. I! 


/ Slowover 


/ .20 / .10 / 

y 

Input Step Ae c / e 

c max 

Failure transient A X 0 /x 


.01 / 


Failure mode 


Configuration 


Slowover 


High gam 


S 


Step Ae r 


c max = 0.01 


0.05 

0.03 

0.07 

0.03 

0.01 

0.01 

0.10 

0.10 

0.20 

0.12 


Figure 42.— Active /Standby Valve/Monitor Configuration Selection 
Failure Transient Summary 
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Figure 43.— Active /Standby Valve /Monitor Configuration Selection 
Oscillatory Failure Summary 
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Figure 47. -Force Summed Valve Configuration Selection , Resolution and 
Transient Test Summary, Normal Performance 
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Figure 48.— Force Summed Valve Configuration Selection , Frequency Response 
Test Summary, One and Two Channel Failures 






Transition time - sec 



Figure 49.— Force Summed Valve Configuration Selection, Transient Test Summary, 
One and Two Channel Failures 
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Figure 50.— Force Summed Valve Configuration Selection Resolution Test Summary , 
One and Two Channel Failures 
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Figure 51.— Pressure Feedback Gain Versus Valve Pressure Gain 
for Force Summed Concept 
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Figure 53.- Resolution, Active /Standby, Normal Operation 
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Figure 57.— Active /Standby , Flow-Gain Sensitivity, Resolution 
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Figure 58.— Active /Standby, F/ow Limit Sensitivity, Transient Response 
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Figure 60.— Active /Standby , Backlash Sensitivity, Resolution 
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Figure 61 .—Active /Standby Friction Sensitivity, Frequency Response 
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Figure 62.— Active /Standby Friction Sensitivity, Transient Response 
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Figure 63.— Active /Standby Friction Sensitivity , Resolution 
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Figure 64.— Active /Standby Damping Sensitivity Frequency Response 
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Figure 66, —Force Summed Flow Gain 
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Figure 69.— Force Summed Backlash Sensitivity, Resolution 
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Figure 71 .—Typical Active/Standby Failure Response , Oscillatory 
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Figure 72— Typical Force Summed Failure Response, Oscillatory 
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Figure 73.— Typical Active /Standby Failure Response , Step, Slowover , High Gain, and Passive 
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Figure 75.— Active /Standby Backlash Sensitivity, Failure Response 
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Figure 77.— Force-Summed Failed Channel Sensitivity , Frequency Response 



Figure 78.— Force Summed Failed Channel Sensitivity, Resolution 
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X^ = Failure rate of actuator channel 
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Figure 79.— Reliability Comparison-Success Diagrams 
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MTBF — Total system loss 



Flight duration, (Hours per flight) 


Figure 80. —Safety Reliability Comparison 
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Table 4.— Summary of FSAA Simulator Testing Procedure 


Cruise and landing approach 

Failure 

category 

Handling qualities level 

Normal Min. safe 

Step 

Introduce secondary actuator steps. Increase magnitude until 
airplane becomes unflyable. 

Slowovers 

Introduce secondary actuator slowovers. Increase slowover rate until 
airplane becomes unflyable. 

Oscillations 

Introduce secondary actuator oscillations. Vary frequency and amplitude. 
Map effect on handling qualities. 

_ _ I .......... 

Control 

discontinuity 

Open command path through secondary actuator momentarily. Vary time 
increment and map effects on handling qualities. 

1 


Cruise and landing approach 

Evaluation 

Handling qualities levels 

category 

Normal 

Min. safe 

Dead band 

Vary secondary actuator dead band. U 

ap effects on handling qualities. 

Hysteresis 

Vary secondary actuator hysteresis. Map effects on handling qualities. 

Threshold 

Vary secondary actuator threshold. Map effects on handling qualities. 


— _ i - 
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OF POOR QUALITY! 


Table 5. -Summary of Active Standby Valve /Monitor Configuration Selection Tests 


Failure 

category 

Valve/monitor configurations 

Configuration Configuration Configuration 

1 II III 

Slowover 

Input .25 deg/sec ramp to active channel until failure occurs. Record system response. 

High gain 

■ 1 

Set feedback gain to zero on active channel. Input .25 deg/sec ramp to this channel-record system 
response. 

Step 

* 1 

Shift input null of active channel 1%, 10% and 20% of maximum command — record system response. 

Command signal oscillation 

1 — — — h 

Oscillatory input to active channel, peak amplitude at 1% and 10% of maximum command signal at 
frequencies of 0.1 Hz, 1.0 Hz and 10 Hz respectively. 

1 1 


U> 

00 
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Table 6.— Summary of Force Summed Valve Configuration Selection Tests 



Valve pressure gain (K p ) x 10' 7 Pa/mA (psi/mA) 


Test category 


Frequency response 


Transient response 


Resolution 



! 0.241 

0.345 

1.379 

6.895 

13.790 

(350) 

(500) 

(2000) 

(10000) 

(20000) 


Input sinusoidal command (5% of e r to system at the following frequencies; .05; .5; 2.5; 5.; 10.; 

’'max 

1 5.; 25.; 50. Hz . Measure amplitude ratio and phase shift between output and input at each 
frequency. 

• Tli i 


Input step command (90% of e r ). Measure time for system to transition to commanded position. 

L max . . . 


Input sinusoidal command to system (90% of e c ) at -01 Hz. Record output versus input signal 
and measure hysteresis and dead band. max 

j i i 1 i 




Rerun tests with valve pressure gains equal to .241 x 10 7 Pa/mA (350 psi/mA) and 6.895 x 10 7 Pa/mA (10000 psi/mA) and with one and two 
channels failed respectively. 












Table 7.— Nominal Actuator Parameters 


Symbol 


Description 


K 


v 1 


K 


Pi 


"v2 


"p2 


K 


A 

M, 


"si 


K 


s2 


M. 


K 


K, 


K 

K > 

(3 

L 


dm 


Servovalve first stage flow gain 
Servovalve first stage pressure gain 
Servovalve second stage flow gain 
Servovalve second stage pressure gain 
Actuator dynamic stiffness 
^4A/3Ks 1 


Ks-L + 4Aj3 
Piston area 

Piston damping coefficient 
Piston mass 
Piston friction 

Actuator backup structural stiffness 

Actuator rod stiffness 

Load mass 

Load damping 

Servo amplifier gain 

Position feedback gain 




Amplifier gain 
Demodulator gain 
LVDT gain 
Oil bulk modulus 
Actuator stroke 


Value 

1.47 x 10" 6 m 3 /sec (.09 in 3 /s) 

1.52 x 10 6 Pa/mA (220 psi/mA) 

6.57 x 10' 7 m 3 /s(.04 in 3 /s) 

6.89 x 10 7 Pa/mA (1x1 0 4 psi/mA) 
1 .92 x 10 6 N/m (1 .095 x 10 4 Ibf/in) 

1.86 x 10‘ 4 m 2 (.289 in 2 ) 

1.4 x 10 3 N/m (8 Ibf-s/in) 

5.95 Kg (.034 lb-s 2 /in) 

1.78N (.4 Ibf) 

1.98 x 10 6 N/m (1.13 x 10 4 Ibf/in) 
1.75 x 10 11 N/m (1 x 1 0 9 Ibf/in) 

56 Kg (.32 lb-s 2 /in) 

2.8 x 10 3 N-s/m (16 Ibf-s/in) 

28.27 mA/V 

6.12 x 10 2 V/m (15.54 V/in) 

.89 V/V 
1.25 V/V 

5.5 x 10 2 V/m (14 V/in) 

1.03 x 10 9 N/m 2 (1.5 x 10 5 lb/in 2 ) 
±1.27 x 1 0" 2 m (±.5 in) 








Table 8.— Frequency Response, Transient Response, and Resolution Test Procedure 


Test 

Procedure 

Frequency response test 

Input a .01 Hz, ±5% sinusoidal command signal into the test configuration. Then measure the 
position output and the command signal with a storage oscilloscope. Vary the command signal 
frequency and repeat the test procedure. System parameters are varied as per table 9 or table 1 1 
for the active/standby or force summed systems, respectively. 

Transient response test 

Input a ±90% step command signal into the test configuration. Record the input command and 
the position output on a strip recorder. Vary system parameters as per table 9 or 1 1 for the active/ 
standby or force summed systems, respectively. 

Resolution test 

Input a .01 Hz, ±90% sinusoidal command signal into the test configuration. Record the input 
command and the position output on an X-Y recorder. Vary system parameters as per tables 9 
and 1 1 , for the active/standby or force summed systems, respectively. 












Table 9.— Parameter Values Used for Parameter Sensitivity 
A nat ysis, A c ti ve /Standby 


Parameter 

Parameter values 

Name 

Symbol 

Units 

Nominal 

First 

variation 

Second 

variation 

Third 

variation 

Pressure gain 

K P 

(psi/mA) 

(10.0 x 10 3 ) 

(2.0 x 10 3 ) 

(20.0 x 10 3 ) 




Pa/mA 

6.9 x 10 7 

1.38 x 10 7 

13.8 x 10 7 

- 

Flow gain 

K v 

(in 3 -mA/s) 

(4.0 x 10- 2 ) 

(2.0 x 10' 2 ) 

(6.0 x 10' 2 ) 



m 3 -mA/s 

6.5 x 10' 7 

3.3 x 10' 7 

9.9 x 10' 7 

- 

Flow limit 

°L 

(in 3 /s) 

(3.95 x 10' 1 ) 

(6.75 x 10' 1 ) 

(9.55 x 10' 1 ) 




m 3 /s 

6.5 x 10‘ 6 

11.1 x 10' 6 

16.0 x 10' 6 

- 

Backlash 

B 

(in) 

(2.0 x 10' 3 ) 

(4.0 x 10" 3 ) 

(1.0 x 10* 2 ) 




m 

5.1 x 10' 5 

10.2 x 10 ° 

25.4 x 10' 5 

- 

Friction 

F 

Obf) 

(0.4) 

(4.0) 

(8.0) 

(20.0) 



N 

1.8 

17.8 

35.6 

89.0 

Damping 

D 

(ibf-s/in) 

(8.0) 

(6.0) 

(10.0) 




N-s/m 

1.4 x 10 3 

1.05 x 10 3 

1.705 x 10 3 

- 

Rod spring 

K s 

(Ibf/in) 

(2.0 x 10 4 ) 

(1.5 x 10 4 ) 

(2.5 x 10 4 ) 




N/m 

3.5 x 10 6 

2.6 x 10 6 

4.4 x 10 6 

- 

Dynamic spring 

K 

(Ibf/in) 

(11.0 x 10 3 ) 

(8.5 x 10 3 ) 

(13.5 x 10 3 ) 




N/m 

1.9 x 10 6 

1.5 x 10 6 

2.4 x 10 6 
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Table 10.— Performance Sensitivity to Parameter Variation, Active /Standby^ ^ 



Test Parameter 

Test Category 

S 

K v 

— 

q l 

B 

(2) f 

D 

K s 

K 

Frequency response 

8.5 

5.5 

8.5 

8.5 

8.5 

BB 

7.5 

8.5 

(-3 dB cutoff, Hz) 

8.0 

8.5 

8.0 

9.0 

5.5 

Ms 

8.5 

8.5 


8.0 

10.5 

8.0 

10.5 

3.5 

D 

9.5 

8.5 

Frequency response 

3.5 


3.5 

3.5 

3.5 

3.5 

3.0 

3.0 

(45° cutoff, Hz) 

3.2 


3.5 

2.5 

2.3 

3.5 

3.5 

3.5 


3.2 

4.0 

3.5 

1.7 

1.5 

3.5 

4.0 

3.5 

Transient response 

0.7 

0.7 

0.7 

1 


0.7 

— 

0.7 

(transition time, sec) 

0.7 

0.7 

0.4 



0.7 

- 

0.7 


0.7 

0.7 

0.3 



0.7 

- 

0.7 






1.1 




Resolution 

4.0 

6.0 


4.0 

4.0 



WM 

{hysteresis loss. 

4.0 

4.0 

- 

5.0 

7.0 



mm 

% ° f w 

4.0 

4.0 

- 

8.0 

8.0 








12.0 



■M 

Slow Over 

5.0 

5.0 

5.0 

5.0 

(3) 5.0 

5.0 

— 

— 

(failure transient. 

5.0 

5.0 

5.0 

6.0 

5.0 

5.0 

- 

- 

% ° f W 

5.0 

5.0 

5.0 

8.0 

4.5 

5.0 




(1) The top entry in each box corresponds to the smaller parameter value, the bottom entry 
to the largest parameter value. 

(2) The 20 Ibf friction data for frequency response was very noisy and was not used for evaluation. 

{3) The tested friction values for the slow over tests were 1.8N, 3.6N, and 8.9N (0.4 Ibf, 0.8 Ibf, 

and 2.0 Ibf). 
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Table 11 .—Parameter Values Used for Parameter Sensitivity 
Analysis, Force Summed 


Parameter 

Parameter values 

Name 

Symbol 

Units 

Nominal 

First 

variation 

Second 

variation 

Third 

variation 

Pressure gain 

k p 

(psi/mA) 

Pa/mA 

(2.2 x 10 2 ) 
1.5 x 10 6 

(3.5 x 10 2 ) 
2.4 x 10 6 

(5.0 x 10 2 ) 
3.4 x 10 6 

- 

Flow gain 

K v 

(in 3 -mA/s) 
-m A/s 

(4.0 x 10-2) 
6.5 x 10* 7 

(2.0 x 10-2) 
3.3 x 10- 7 

(6.0 x 10- 2 ) 
9.9 x 10- 7 

- 

Flow limit 

q l 

(in 3 /s) 

m 3 /s 

(3.95 x 10' 1 ) 
6.5 x 10- 6 

(6.75 x lO' 1 ) 
11.1 x 10' 6 

(9.55 x 10* 1 ) 
16.0 x 10' 6 

- 

Backlash 

B 

(in) 

m 

(2.0 x 10' 3 ) 
5.1 x 10-5 

(4.0 x 10' 3 ) 
10.2 x 10-5 

(1.0 x 10- 2 ) 
25.4 x 10-5 

- 

Friction 

F 

(Ibf) 

N 

(0.4) 

1.8 

(4.0) 

17.8 

(8.0) 

35.6 

(20.0) 

89.0 

Damping 

D 

(lbf-s/in) 

N-s/m 

(8.0) 

1.4 x 10 3 

(6.0) 

1.05 x 10 3 

(10.0) 

1.705 x 10 3 

- 

Rod spring 

K s 

(Ibf /in) 
N/m 

(2.0 x 10 4 ) 
3.5 x 10 6 

(1.5 x 10 4 ) 
2.6 x 10 6 

(2.5 x 10 4 ) 
4.4 x 10 6 

- 

Dynamic spring 
■ — 

K 

(Ibf/in) 

N/m 

(11.0 x 10 3 ) 
1.9 x 10 6 

(8.5 x 10 3 ) 
1.5 x 10 6 

(13.5 x 10 3 ) 
2.4 x 10 6 

- 
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Table 12. -Performance Sensitivity to Parameter Variation , Force Summed^ 1 * 



Test Parameters 


Test Category 

S 

K v 

°L 

B 

F 

D 

K s 

K 

Frequency response 

14.0 

7.5 

13.5 

13.5 

El 

El 

13.0 

14.0 

(-3 dB cutoff, Hz) 

13.5 

13.5 

14.0 

15.5 

wem 

IBS 

13.5 

13.5 


13.5 

18.0 

13.5 

20.0 

13.5 

13.5 

13.0 

13.5 






12.0 




Frequency response 

6.5 

4.0 

6.0 

6.0 

6.0 

7.0 

5.5 

6.0 

(45° cutoff, Hz) 

6.0 

6.0 

6.5 

5.5 

6.0 

6.0 

6.0 

6.0 


7.0 

8.0 

6.0 

3.0 

6.0 

6.5 

7.0 

6.5 






7.5 




llBiWM 

Transient response 

0.7 

0.8 

0.7 

— 

0.7 


— 


(transition time— sec) 

0.7 

0.7 

0.4 

- 

0.7 

mam 

— 



0.7 

0.7 

0.3 

- 

0.7 

0.7 

- 

0.7 






0.7 




Resolution 

3.0 

5.0 



3.0 

3.0 

— 

— 

3.0 

(hysteresis loss, 

3.0 

3.0 

- 

3.0 

3.0 

- 

- 

3.0 

% of X max ) 

3.0 

2.0 

- 

3.0 

3.0 

- 

- 

3.0 






3.0 




Slowover 

■H 


1.8 

1.8 

1.8 

1.8 

__ 

n 

(failure transient. 

■n 

m 

1.8 

2.0 

1.6 

1.8 

- 

ra 

% ° f w 

1.8 

1.8 

1.8 

2.4 

1.6 

1.8 

— 

1.8 






1.6 





(1 ) The top entry in each box corresponds to the smallest of the parameter values, the bottom 
entry to the largest parameter value. 
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Table 1 3. -Slowover- Induced Failure Transients, Active /Stand by 




Failure Transient, % of X (T|ax 



k p 

K v 

q l 

B 

nip 

D 

Nominal parameter 

5 

5 

5 

5 

5 

5 

1st deviation 

5 

5 

5 

6 

5 

5 

2nd deviation 

5 

5 

5 

8 

4.5 

5 

3rd deviation 

- 

- 


- 

5 




(1) Friction values for the slowover tests were 1.8N, 3.6N, and 8.9N(0.4 Ibf, 
.8 Ibf, and 2.0 Ibf). 


Table 14.— Slowover- Induced Failure Transients , with Position Offsets T Active /Standby 



Failure Transient^ 

Position 

offset 

% ° f X max 

Offset the 
active 
actuator 

< % ° f W 

Offset the 
active 
monitor 

,% ° f> w 

Offset the 
standby 
actuator 

< % ° f w 

0 

5 

5 

5 

1.25 

5 

6, 3 

6,3 

2.5 

5 

7 , 2 

8,2 


(1 } Whenever two failure transient values are given, the larger value 
represents the failure transient for the actuator driving away 
from the position offset, and the smaller value is for the actuator 
driving in the direction of the position offset. 
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Table 15.- Oscillatory-Induced Failure Transients, Active /Standby 


Failure conditions 

Failure response 

Oscillatory 

Standby chan- 
nel offset 

< % ° fX max> 

Failure 

transient 

«° fX max> 

Failure 
detected 
(Yes, No) 

Freq 

(Hz) 

Amp 

< % ° f X max> 

0.1 

10.0 

0.0 

7.0 

Yes 

(1) 

1.0 

10.0 

0.0 

7.0 

Yes 

(1) 

10.0 

10.0 

0.0 

±2.5 

No 


0.1 

10.0 

1.25 

8.0 

Yes 

(1) 

1.0 

10.0 

1.25 

10.0 

Yes 

(1) 

10.0 

10.0 

1.25 

£2.5 

No 


0.1 

10.0 

2.50 

12.0 

Yes 

(D 

1.0 

10.0 

2.50 

12.0 

Yes 

(1) 

10.0 

10.0 

2.50 

±2.5 

No 


0.1 

1.0 

2.50 

±1 

No 


1.0 

1.0 

2.50 

±1 

No 


10.0 

1.0 

2.50 

±.5 

No 



(1) Low-frequency, large amplitude oscillations are detected as a slow-over 
failure. 
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Table 16.— Step-Induced Failure Transients, Active /Standby 


Step 

° f X max> 

Standby chan- 
nel offset 
(%of X max l 

Failure 

transient 

< %of W 

1 

0.0 

1.5 

10 

0.0 

10 

1 

1.25 

1.5 

10 

1.25 

11 

1 

2.5 

1 

10 

2.5 

14 


Table 17. -High-Gain and Passive Induced Failure Transients, Active /Stand by ' 


Failure 

category 

Standby chan- 
nel offset 

« of X max' 

Failure 

transient 

< % ° f X max> 

High gain 

0.0 

3 

High gain 

1.25 

7 

High gain 

2.5 

10 

Passive 

0.0 

3 

Passive 

1.25 

6 

Passive 

2.5 

8 
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Table 18.— Slowover- Induced Transients, Force Summed 



Failure Transient, % of 

max 

S 

«v 

°L 

B 

F 

D 

K 

Ay 

Nominal parameter 

1.8 

1.8 

1.8 

1.8 

1.8 

1.8 

1.8 

1.8 

1st deviation 

1.8 

1.8 

1.8 

2.0 

1.6 

1.8 

1.8 

1.8 

2nd deviation 

1.8 

1.8 

1.8 

2.4 

1.6 

1.8 

1.8 

1.8 

3rd deviation 

- 

- 

- 

- 

1.6 

- 

- 

- 
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Table 19.— Oscillatory Failure Induced Transients , Force Summed 



Failure conditions 


Failure response j 

Oscillatory 

Position 

offset 

Disengaged 

channels 

Output 

transients 

Failure 

detected 

Freq 

(Hz) 

Amp 

l%of X max ) 

(%0fX max ) 

(No.) 

(% of X m ) 
max 

(Yes, No) 

0.1 

10.0 

0.0 

0 

.5 


1.0 

10.0 

0.0 

0 

' .5 


10.0 

10.0 

0.0 

0 

.3 


0.1 

1.0 

0.0 

0 

0.0 


1.0 

1.0 

0.0 

0 

0.0 


10.0 

1.0 

0.0 

0 

.15 


0.1 

10.0 

1.25 

0 

.5 


i.o 

10.0 

1.25 

0 

.5 


10.0 

10.0 

1.25 

0 

.3 


0.1 

1.0 

1.25 

0 

0.0 


1.0 

1.0 

1.25 

0 

0.0 

0> 

10.0 

1.0 

1.25 

0 

.15 

o 

c 

0.1 

10.0 

2.50 

0 

.5 


1.0 

10.0 

2.50 

0 

.5 


10.0 

10.0 

2.50 

0 

.3 


0.1 

1.0 

2.50 

0 

0.0 


1.0 

1.0 

2.50 

0 

0.0 


10.0 

1.0 

2.50 

0 

.15 


0.1 

10.0 

0.0 

1 

.5 


1.0 

10.0 

0.0 

1 

.5 


10.0 

10.0 

0.0 

1 

.3 


0.1 

1.0 

0.0 

1 

0.0 


1.0 

1.0 

0.0 

1 

0.0 


10.0 

1.0 

0.0 

J 

1 

.15 
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Table 20.— Step-Induced Failure Transients , Force Summed 


Step 

< %of W 

Disengaged 

channels 

(no.) 

Output 
transient (1) 

1 

0 

.05 

10 

0 

0.6 

1 

1 

0.1 

10 

1 

0.7 


0) No failures detected 


Table 21.— High Gain and Passive Failure Induced Transients , 
Force Summed 


Failure 

category 

System position 
offset 

< % ° f X max> 

Disengaged 

channels 

(no.) 

Output 
transients 
(% of X max ) 

High gain 

0 

0 

2.3 

High gain 

25 

0 

- 

High gain 

0 

1 

2.3 

Passive 

0 

0 

1.0 

Passive 

25 

0 

1.0 

Passive 

0 

1 

1.2 
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Table 22.— Channel-Failure-Induced Performance Degradation , Force Summed 


Disengaged 

channels 

-3 dB Cutoff 

Transition time 

Hysteresis loss 

Steady state output 

5% command 

90% command 

(No.) 

(Hz) 

(Sec) 

«° f W 

(%of w 

< % ° f X max> 

0 

15 

.7 

3 

• 

5 

90 

1 

10 

.75 

4 

4 

85 

ro 

9 

.85 

6 

2.5 

75 


Table 23— Safety /Maintenance Reliability Comparison 


MTBF (1> (HRS) 

Active/standby 

Force summed 

First 

Total system 

First 

Total system 

failure 

loss 

failure 

loss 

1110 

4.115 

910 

1.339 


(x 10 9 ) 


(x 10 9 ) 


(1) MTBF {Mean Time Between Failures) Based on 3-Hour Flight 
Duration For Total System Loss 
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4.0 SECONDARY ACTUATOR DESIGN CRITERIA 


The previously discussed results of the analog computer and analytical studies in 
combination with the results of the piloted motion simulator study provide the basis to 
establish the actuator system’s detailed definitions. This section summarizes the major 
criteria selection, limitations, and considerations, and establishes preliminary specifications 
for the actuator concepts. 


4.1 DESIGN CRITERIA SELECTION 

A summary of the allowable failure transients and actuator system failure transient 
characteristics is shown in table 24. The allowable transients are shown for a first failure 
condition and for a second failure condition. Both failure conditions are shown for a landing 
approach flight configuration and a high speed cruise flight configuration. This summary 
contains only one set of characteristics for the active/standby system, since there are no 
changes in performance following a failure switchover to a standby channel. For the force 
summed system, however, there are changes in performance as a channel failure occurs. 
Therefore, two sets of failure capability data are shown for the force summed system; one 
with four channels operating and one with three channels operating. 

The allowable failure transients were established from the FSAA simulation testing. These 
tests are summarized in paragraph 2.3. The failure transient characteristics of the 
active/standby and force summed systems were determined from the analog computer 
study. The analog study results are summarized in paragraph 2.4. 

No oscillatory failure monitoring system was incorporated in either of the two actuator 
system models evaluated. Therefore, as shown on the summary table (table 24), neither the 
active/standby nor the force summed system satisfies the oscillatory allowable failure 
transients. 

The force summed actuator system satisfies the maximum allowable transients for all failure 
modes except the oscillatory failures. 

The active/standby actuator system satisfies the maximum allowable transients for all failure 
modes except the step and oscillatory failures. In summary, the force summed system has 
the capability to satisfy the SST piloted requirements, with exception of the oscillatory 
transients. Whereas, the active/standby system tested has poorer failure transient perform- 
ance as compared to the force summed system and does not totally satisfy the SST 
maximum allowable transients. The development of an improved failure monitor system 
would be required for the active/standby system to be competitive with the force summed 
system. 

Additional failure transient capability is needed in both concepts to detect oscillatory 
failures. 
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4.2 DESIGN CRITERIA CONSIDERATIONS AND LIMITATIONS 


Design criteria tor the active/standby and force summed secondary actuator concepts were 
primarily based on the FSAA simulator test results. This simulator study evaluated the 
Boeing 2707-300 airplane, flown in a manual control mode. The test results are therefore 
typical for this airplane and its control systems. 


Although criteria sensitivity to airplane model variations has not been established in this 
study, the criteria presented in this document are considered an appropriate base for other 
AST airplane configurations flown in a manual control mode. 


When selecting design criteria for a secondary actuator application, consideration must be 
given to all requirements. In addition to the manual mode of operation, a typical transport 
type airplane will be equipped with an autopilot, an autoland system, and most likely in the 
case of an AST, some type of structural mode suppression system. Any, or all, of these 
systems can impose stringent requirements on the control system characteristics. The 
requirements of these automatic control functions are not defined in this document. 

4.3 SECONDARY ACTUATOR DESIGN SPECIFICATION 

Preliminary detailed actuator design definition for both the active/standby and force 
summed secondary actuator systems are included in tables 25 and 26. The criteria are based 
on the nominal baseline design parameters used in the study, modified consistent with the 
conclusions of this study. 
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Table 24.— Failure Transient Criteria /Capability Summary 


Failure 

criteria 

Maximum 

allowable transient (1) 

Actuator system 
transient capability {% Xmax) 

1st failure 

2nd failure 

Active/ 

standby 

Force summed 

1st failure 

2nd failure 

Step 

12/5 

38/18 

10 

.6 

.7 

High gain 

12/5 

38/18 

3 

2.3 

2.3 

Passive 

12/5 

38/18 

3 

1 

1..2 

Oscillatory (0.1 Hz) 

0 

0 

7 

.5 

.5 

Oscillatory (1 Hz) 

8.5/1. 5 

27/- 

8 

.5 

.5 

Oscillatory (10 Hz) 

- 

- 

2.5 

.3 

.3 

Switch delay 

1 sec 

3.65 sec 

- 

— 

- 

Slowover 

- 

- 

5 

1.8 

1.8 


(1) Landing approach/high speed cruise 





















Table 25. -Active /Standby Actuator Design Specification 


Unit criteria 

- 

S.l. Units 

(U.S. Units) 

Number of actuator channels 

3 

(3) 

Piston area 

1.9 x 10* 4 m 2 

(.294 in 2 ) 

Rated velocity 

6.6 x 10’ 2 m/s 

{2.6 in/s) 

Force output/channel 

4000 

(900 Ibf) 

Open loop gain 

60 sec' 1 

(60 sec* 1 ) 

Maximum damping/channel 

1400 N-s/m 

(8 Ibf -s/in) 

Maximum friction/channel 

1.8 N 

(.4 Ibf) 

Resolution 

2% 

(2%) 

Threshold 

0.1% 

(0.1%) 

Linearity 

±2% 

(±2%) 

Weight 

10.4 Kg 

(23 lb) 

Total piston stroke 

5.08 x 10* 2 m 

(2 in) 

Actuator Valve 



Rated input voltage {max) 

25 v 

(25 v) - 

Flow gain 

6.6 x 10" 7 m^-mA/s 

(.04 in^-mA/s) 

Pressure gain 

6.9 x 10 7 Pa/m A 

(10^ psi/mA) 

Monitor Valve 



Rated input voltage (max) 

25 v 

(25 v) 
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Table 26.— Force Summed Actuator Design Specification 


Unit Criteria 

S.l. Units 

(U.S. Units) 

Number of actuator channels 

4 

(4) 

Piston area 

1.9 x 10‘ 4 m 2 

(.294 in 2 ) 

Rated velocity 

6.6 x 10' 2 m/s 

(2.6 in/s) 

Force output/channe! 

1335 

(300 Ibf) 

Open loop gain 

60 sec' 1 

(60 sec' 1 ) 

Maximum damping /channel 

1400 N-s/m 

(8 Ibf -s/in) 

Maximum friction/channel 

1.8 N 

(.4 Ibf) 

Resolution 

2% 

(2%) 

Threshold 

0.1% 

(0.1%) 

Linearity 

±2% 

(±2%) 

Weight 

13.6 Kg 

(30 lb) 

Total piston stroke 

5.08 x 10‘ 2 m 

(2 in) 

Actuator Valve 



Rated input voltage 

25 v 

(25 v) 

Flow gain 

6.6 x tO" 7 m^-mA/s 

(.04 in^-mA/s) 

Pressure gain 

1.52 x 10 6 Pa/m A 

(220 psi/mA) 
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5.0 ACTUATION CONCEPT APPLICABILITY 


The previously discussed study results provide the basis to judge and to establish the 
applicability and practicality for using the two actuator concepts in an AST and other type 
aircraft control systems. 

5.1 APPLICABILITY OF ACTUATOR CONCEPTS TO AST CONTROL SYSTEMS 

AST airplanes will operate throughout a large speed and altitude range. Unstable 
configurations in the subsonic speed range will more than likely prevail. At higher 
supersonic speeds stability would increase. To operate these airplanes economically, stability 
margins must be selected such that flight-critical augmentation systems are required for 
safety of flight. Other characteristics of an AST affecting control system performance 
requirements are structural flexibility and control sensitivity at cruise. 

Tire requirements on AST control system performance are great. Phase and gain 
characteristics must be rigorously controlled throughout the frequency spectrum within 
which these systems are to operate. Secondary servos will be used as intermediate signal 
conversion stages in augmentation systems as well as in other automatic control systems. 
Phase and gain variations in the secondary actuators must be held to a minimum by 
judiciously selecting linear actuator parameters and by minimizing nonlinear effects. Due to 
the high control effectivenss at cruise, failure transients due to channel failures must be 
minimized to avoid catastrophic upsets. As these augmentation systems are flight critical, 
system reliability must approach that of the airplane structure. 

The comparison of the two secondary actuator concepts in section 2.0 indicates that the 
force summed concept meets performance requirements better than the active/standby 
concept. However, the active/standby is superior in meeting reliability requirements. Based 
on these observations the force summed secondary actuator system would be the most 
likely candidate for an AST application. 

5.2 APPLICABILITY OF ACTUATOR CONCEPTS TO AIRCRAFT OTHER THAN AST 

Conventional subsonic transport airplanes are normally stable vehicles that do not require 
stability augmentation other than to complement flying qualities characteristics. Secondary 
actuators are used in these types of aircraft in yaw damper and autopilot systems. Both of 
these system types operate in the low frequency ranges of rigid airplane dynamics. 
Frequency response requirements for these systems are relatively low. Control surface 
sensitivity on subsonic aircraft is normally low as compared to that of an AST, especially at 
cruise. With this low sensitivity, normal surface travel is relatively large. This, and the 
inherent stability of the airplane, require less stringent performance capabilities. Also, due 
to the reduced control surface sensitivity, upsets due to control system failure modes will be 
less severe than would the case for the AST. 

For these reasons, more emphasis will be placed on characteristics such as maintainability 
and cost than on high performance when selecting a secondary actuator concept for this 
type of airplane. The comparison of the active/standby and force summed systems made in 


pa qm 




Hwmtm 
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section 2.4, indicates that the active/standby system is superior in this respect. If, however, 
selections are to be made for subsonic advanced technology transports, the requirements on 
performance might well be as stringent as those for an AST. 

A number of advanced technology augmentation systems are being considered. Examples 
are stability augmentation of airplane with relaxed static stability, load alleviation and mode 
suppression. All these control systems are augmenting marginally stable and unstable 
dynamics in an extended frequency spectrum. Therefore, the performance and reliability 
requirements may again become paramount. In the evaluation of the two concepts, the 
force summed system has the better performance and would be the most likely choice for 
an advanced technology airplane. 
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